Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
libvirt.33143
8a3f8d95-CVE-2024-2494.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 8a3f8d95-CVE-2024-2494.patch of Package libvirt.33143
commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2 Author: Daniel P. Berrangé <berrange@redhat.com> Date: Fri Mar 15 10:47:50 2024 +0000 remote: check for negative array lengths before allocation While the C API entry points will validate non-negative lengths for various parameters, the RPC server de-serialization code will need to allocate memory for arrays before entering the C API. These allocations will thus happen before the non-negative length check is performed. Passing a negative length to the g_new0 function will usually result in a crash due to the negative length being treated as a huge positive number. This was found and diagnosed by ALT Linux Team with AFLplusplus. CVE-2024-2494 Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Found-by: Alexandr Shashkin <dutyrok@altlinux.org> Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Index: libvirt-7.1.0/src/remote/remote_daemon_dispatch.c =================================================================== --- libvirt-7.1.0.orig/src/remote/remote_daemon_dispatch.c +++ libvirt-7.1.0/src/remote/remote_daemon_dispatch.c @@ -2330,6 +2330,10 @@ remoteDispatchDomainGetSchedulerParamete if (!conn) goto cleanup; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -2378,6 +2382,10 @@ remoteDispatchDomainGetSchedulerParamete if (!conn) goto cleanup; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -2536,6 +2544,10 @@ remoteDispatchDomainBlockStatsFlags(virN goto cleanup; flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -2764,6 +2776,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNe if (!(dom = get_nonnull_domain(conn, args->dom))) goto cleanup; + if (args->ncpumaps < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative")); + goto cleanup; + } + if (args->maplen < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); + goto cleanup; + } if (args->ncpumaps > REMOTE_VCPUINFO_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX")); goto cleanup; @@ -2858,6 +2878,11 @@ remoteDispatchDomainGetEmulatorPinInfo(v if (!(dom = get_nonnull_domain(conn, args->dom))) goto cleanup; + if (args->maplen < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); + goto cleanup; + } + /* Allocate buffers to take the results */ if (args->maplen > 0) cpumaps = g_new0(unsigned char, args->maplen); @@ -2905,6 +2930,14 @@ remoteDispatchDomainGetVcpus(virNetServe if (!(dom = get_nonnull_domain(conn, args->dom))) goto cleanup; + if (args->maxinfo < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); + goto cleanup; + } + if (args->maplen < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); + goto cleanup; + } if (args->maxinfo > REMOTE_VCPUINFO_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX")); goto cleanup; @@ -3145,6 +3178,10 @@ remoteDispatchDomainGetMemoryParameters( flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -3205,6 +3242,10 @@ remoteDispatchDomainGetNumaParameters(vi flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -3265,6 +3306,10 @@ remoteDispatchDomainGetBlkioParameters(v flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -3326,6 +3371,10 @@ remoteDispatchNodeGetCPUStats(virNetServ flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -3393,6 +3442,10 @@ remoteDispatchNodeGetMemoryStats(virNetS flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -3573,6 +3626,10 @@ remoteDispatchDomainGetBlockIoTune(virNe if (!conn) goto cleanup; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -5117,6 +5174,10 @@ remoteDispatchDomainGetInterfaceParamete flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; @@ -5337,6 +5398,10 @@ remoteDispatchNodeGetMemoryParameters(vi flags = args->flags; + if (args->nparams < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); + goto cleanup; + } if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); goto cleanup; Index: libvirt-7.1.0/src/rpc/gendispatch.pl =================================================================== --- libvirt-7.1.0.orig/src/rpc/gendispatch.pl +++ libvirt-7.1.0/src/rpc/gendispatch.pl @@ -1073,6 +1073,11 @@ elsif ($mode eq "server") { print "\n"; if ($single_ret_as_list) { + print " if (args->$single_ret_list_max_var < 0) {\n"; + print " virReportError(VIR_ERR_RPC,\n"; + print " \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n"; + print " goto cleanup;\n"; + print " }\n"; print " if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n"; print " virReportError(VIR_ERR_RPC,\n"; print " \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
