a026aabb02
- qemu: avoid denial of service reading from QEMU guest agent CVE-2018-1064 fbf31e1a-CVE-2018-1064.patch bsc#1083625 - virtlockd: fix loosing lock on re-exec 464889ff-rpc-aquire-ref-dispatch.patch, c6f1d519-rpc-simplify-dispatch.patch, 06e7ebb6-rpc-invoke-dispatch-unlocked.patch, 86cae503-rpc-fix-pre-exec.patch, eefabb38-rpc-virtlockd-virtlogd-single-thread.patch bsc#1076861 - libvirtd: fix potential deadlock when reloading 33c6eb96-fix-libvirtd-reload-deadlock.patch bsc#1079150 OBS-URL: https://build.opensuse.org/request/show/586966 OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=676
52 lines
2.1 KiB
Diff
52 lines
2.1 KiB
Diff
commit fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
|
|
Author: Daniel P. Berrangé <berrange@redhat.com>
|
|
Date: Thu Mar 1 14:55:26 2018 +0000
|
|
|
|
qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)
|
|
|
|
We read from the agent until seeing a \r\n pair to indicate a completed
|
|
reply or event. To avoid memory denial-of-service though, we must have a
|
|
size limit on amount of data we buffer. 10 MB is large enough that it
|
|
ought to cope with normal agent replies, and small enough that we're not
|
|
consuming unreasonable mem.
|
|
|
|
This is identical to the flaw we had reading from the QEMU monitor
|
|
as CVE-2018-5748, so rather embarrassing that we forgot to fix
|
|
the agent code at the same time.
|
|
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
|
Index: libvirt-4.1.0/src/qemu/qemu_agent.c
|
|
===================================================================
|
|
--- libvirt-4.1.0.orig/src/qemu/qemu_agent.c
|
|
+++ libvirt-4.1.0/src/qemu/qemu_agent.c
|
|
@@ -53,6 +53,15 @@ VIR_LOG_INIT("qemu.qemu_agent");
|
|
#define DEBUG_IO 0
|
|
#define DEBUG_RAW_IO 0
|
|
|
|
+/* We read from QEMU until seeing a \r\n pair to indicate a
|
|
+ * completed reply or event. To avoid memory denial-of-service
|
|
+ * though, we must have a size limit on amount of data we
|
|
+ * buffer. 10 MB is large enough that it ought to cope with
|
|
+ * normal QEMU replies, and small enough that we're not
|
|
+ * consuming unreasonable mem.
|
|
+ */
|
|
+#define QEMU_AGENT_MAX_RESPONSE (10 * 1024 * 1024)
|
|
+
|
|
/* When you are the first to uncomment this,
|
|
* don't forget to uncomment the corresponding
|
|
* part in qemuAgentIOProcessEvent as well.
|
|
@@ -535,6 +544,12 @@ qemuAgentIORead(qemuAgentPtr mon)
|
|
int ret = 0;
|
|
|
|
if (avail < 1024) {
|
|
+ if (mon->bufferLength >= QEMU_AGENT_MAX_RESPONSE) {
|
|
+ virReportSystemError(ERANGE,
|
|
+ _("No complete agent response found in %d bytes"),
|
|
+ QEMU_AGENT_MAX_RESPONSE);
|
|
+ return -1;
|
|
+ }
|
|
if (VIR_REALLOC_N(mon->buffer,
|
|
mon->bufferLength + 1024) < 0)
|
|
return -1;
|