forked from pool/libvirt
26 lines
895 B
Diff
26 lines
895 B
Diff
|
commit 8afa68bac0cf99d1f8aaa6566685c43c22622f26
|
||
|
|
Author: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Date: Fri Jun 14 09:16:14 2019 +0200
|
||
|
|
|
||
|
|
api: disallow virConnectGetDomainCapabilities on read-only connections
|
||
|
|
|
||
|
|
This API can be used to execute arbitrary emulators.
|
||
|
|
Forbid it on read-only connections.
|
||
|
|
|
||
|
|
Fixes: CVE-2019-10167
|
||
|
|
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
|
||
|
|
Index: libvirt-5.4.0/src/libvirt-domain.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-5.4.0.orig/src/libvirt-domain.c
|
||
|
|
+++ libvirt-5.4.0/src/libvirt-domain.c
|
||
|
|
@@ -11360,6 +11360,7 @@ virConnectGetDomainCapabilities(virConne
|
||
|
|
virResetLastError();
|
||
|
|
|
||
|
|
virCheckConnectReturn(conn, NULL);
|
||
|
|
+ virCheckReadOnlyGoto(conn->flags, error);
|
||
|
|
|
||
|
|
if (conn->driver->connectGetDomainCapabilities) {
|
||
|
|
char *ret;
|