forked from pool/libvirt
28 lines
1.0 KiB
Diff
28 lines
1.0 KiB
Diff
|
commit db0b78457f183e4c7ac45bc94de86044a1e2056a
|
||
|
|
Author: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Date: Fri Jun 14 09:14:53 2019 +0200
|
||
|
|
|
||
|
|
api: disallow virDomainManagedSaveDefineXML on read-only connections
|
||
|
|
|
||
|
|
The virDomainManagedSaveDefineXML can be used to alter the domain's
|
||
|
|
config used for managedsave or even execute arbitrary emulator binaries.
|
||
|
|
Forbid it on read-only connections.
|
||
|
|
|
||
|
|
Fixes: CVE-2019-10166
|
||
|
|
Reported-by: Matthias Gerstner <mgerstner@suse.de>
|
||
|
|
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
|
||
|
|
Index: libvirt-5.4.0/src/libvirt-domain.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-5.4.0.orig/src/libvirt-domain.c
|
||
|
|
+++ libvirt-5.4.0/src/libvirt-domain.c
|
||
|
|
@@ -9563,6 +9563,7 @@ virDomainManagedSaveDefineXML(virDomainP
|
||
|
|
|
||
|
|
virCheckDomainReturn(domain, -1);
|
||
|
|
conn = domain->conn;
|
||
|
|
+ virCheckReadOnlyGoto(conn->flags, error);
|
||
|
|
|
||
|
|
if (conn->driver->domainManagedSaveDefineXML) {
|
||
|
|
int ret;
|