52 lines
2.1 KiB
Diff
52 lines
2.1 KiB
Diff
|
commit fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
|
||
|
|
Author: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
Date: Thu Mar 1 14:55:26 2018 +0000
|
||
|
|
|
||
|
|
qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)
|
||
|
|
|
||
|
|
We read from the agent until seeing a \r\n pair to indicate a completed
|
||
|
|
reply or event. To avoid memory denial-of-service though, we must have a
|
||
|
|
size limit on amount of data we buffer. 10 MB is large enough that it
|
||
|
|
ought to cope with normal agent replies, and small enough that we're not
|
||
|
|
consuming unreasonable mem.
|
||
|
|
|
||
|
|
This is identical to the flaw we had reading from the QEMU monitor
|
||
|
|
as CVE-2018-5748, so rather embarrassing that we forgot to fix
|
||
|
|
the agent code at the same time.
|
||
|
|
|
||
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
|
||
|
|
Index: libvirt-4.1.0/src/qemu/qemu_agent.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-4.1.0.orig/src/qemu/qemu_agent.c
|
||
|
|
+++ libvirt-4.1.0/src/qemu/qemu_agent.c
|
||
|
|
@@ -53,6 +53,15 @@ VIR_LOG_INIT("qemu.qemu_agent");
|
||
|
|
#define DEBUG_IO 0
|
||
|
|
#define DEBUG_RAW_IO 0
|
||
|
|
|
||
|
|
+/* We read from QEMU until seeing a \r\n pair to indicate a
|
||
|
|
+ * completed reply or event. To avoid memory denial-of-service
|
||
|
|
+ * though, we must have a size limit on amount of data we
|
||
|
|
+ * buffer. 10 MB is large enough that it ought to cope with
|
||
|
|
+ * normal QEMU replies, and small enough that we're not
|
||
|
|
+ * consuming unreasonable mem.
|
||
|
|
+ */
|
||
|
|
+#define QEMU_AGENT_MAX_RESPONSE (10 * 1024 * 1024)
|
||
|
|
+
|
||
|
|
/* When you are the first to uncomment this,
|
||
|
|
* don't forget to uncomment the corresponding
|
||
|
|
* part in qemuAgentIOProcessEvent as well.
|
||
|
|
@@ -535,6 +544,12 @@ qemuAgentIORead(qemuAgentPtr mon)
|
||
|
|
int ret = 0;
|
||
|
|
|
||
|
|
if (avail < 1024) {
|
||
|
|
+ if (mon->bufferLength >= QEMU_AGENT_MAX_RESPONSE) {
|
||
|
|
+ virReportSystemError(ERANGE,
|
||
|
|
+ _("No complete agent response found in %d bytes"),
|
||
|
|
+ QEMU_AGENT_MAX_RESPONSE);
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
if (VIR_REALLOC_N(mon->buffer,
|
||
|
|
mon->bufferLength + 1024) < 0)
|
||
|
|
return -1;
|