forked from pool/libvirt
34 lines
1.2 KiB
Diff
34 lines
1.2 KiB
Diff
|
commit bf6c2830b6c338b1f5699b095df36f374777b291
|
||
|
|
Author: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Date: Fri Jun 14 09:17:39 2019 +0200
|
||
|
|
|
||
|
|
api: disallow virConnect*HypervisorCPU on read-only connections
|
||
|
|
|
||
|
|
These APIs can be used to execute arbitrary emulators.
|
||
|
|
Forbid them on read-only connections.
|
||
|
|
|
||
|
|
Fixes: CVE-2019-10168
|
||
|
|
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
|
||
|
|
Index: libvirt-5.4.0/src/libvirt-host.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-5.4.0.orig/src/libvirt-host.c
|
||
|
|
+++ libvirt-5.4.0/src/libvirt-host.c
|
||
|
|
@@ -1041,6 +1041,7 @@ virConnectCompareHypervisorCPU(virConnec
|
||
|
|
|
||
|
|
virCheckConnectReturn(conn, VIR_CPU_COMPARE_ERROR);
|
||
|
|
virCheckNonNullArgGoto(xmlCPU, error);
|
||
|
|
+ virCheckReadOnlyGoto(conn->flags, error);
|
||
|
|
|
||
|
|
if (conn->driver->connectCompareHypervisorCPU) {
|
||
|
|
int ret;
|
||
|
|
@@ -1234,6 +1235,7 @@ virConnectBaselineHypervisorCPU(virConne
|
||
|
|
|
||
|
|
virCheckConnectReturn(conn, NULL);
|
||
|
|
virCheckNonNullArgGoto(xmlCPUs, error);
|
||
|
|
+ virCheckReadOnlyGoto(conn->flags, error);
|
||
|
|
|
||
|
|
if (conn->driver->connectBaselineHypervisorCPU) {
|
||
|
|
char *cpu;
|