From: Bruce Ashfield <bruce.ashfield@gmail.com>
To: asharma@mvista.com
Cc: meta-virtualization@lists.yoctoproject.org
Subject: Re: [meta-virtualization][dunfell][PATCH V2] libvirt: Backport fix for CVE-2024-2494
Date: Tue, 9 Apr 2024 10:01:52 -0400 [thread overview]
Message-ID: <CADkTA4NwaG5bbZKZFK44gFufAiwi+h1qx+yET762p=L0+2G9Jw@mail.gmail.com> (raw)
In-Reply-To: <20240325143729.11867-1-asharma@mvista.com>
[-- Attachment #1: Type: text/plain, Size: 12482 bytes --]
On Mon, Mar 25, 2024 at 10:37 AM Ashish Sharma via lists.yoctoproject.org
<asharma=mvista.com@lists.yoctoproject.org> wrote:
> Upstream-Status: Backport [
> https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2
> ]
> Signed-off-by: Ashish Sharma <asharma@mvista.com>
> ---
> .../libvirt/libvirt/CVE-2024-2494.patch | 220 ++++++++++++++++++
> recipes-extended/libvirt/libvirt_6.1.0.bb | 1 +
> 2 files changed, 221 insertions(+)
> create mode 100644 recipes-extended/libvirt/libvirt/CVE-2024-2494.patch
>
> diff --git a/recipes-extended/libvirt/libvirt/CVE-2024-2494.patch
> b/recipes-extended/libvirt/libvirt/CVE-2024-2494.patch
> new file mode 100644
> index 00000000..99c5eec9
> --- /dev/null
> +++ b/recipes-extended/libvirt/libvirt/CVE-2024-2494.patch
> @@ -0,0 +1,220 @@
> +From 8a3f8d957507c1f8223fdcf25a3ff885b15557f2 Mon Sep 17 00:00:00 2001
> +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
> +Date: Fri, 15 Mar 2024 10:47:50 +0000
> +Subject: [PATCH] remote: check for negative array lengths before
> allocation
> +MIME-Version: 1.0
> +Content-Type: text/plain; charset=UTF-8
> +Content-Transfer-Encoding: 8bit
> +
> +While the C API entry points will validate non-negative lengths
> +for various parameters, the RPC server de-serialization code
> +will need to allocate memory for arrays before entering the C
> +API. These allocations will thus happen before the non-negative
> +length check is performed.
> +
> +Passing a negative length to the g_new0 function will usually
> +result in a crash due to the negative length being treated as
> +a huge positive number.
> +
> +This was found and diagnosed by ALT Linux Team with AFLplusplus.
> +
> +CVE-2024-2494
> +Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
> +Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
> +Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
> +Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> +
> +CVE: CVE-2024-2494
> +Upstream-Status: Backport [
> https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2
> ]
> +Signed-off-by: Ashish Sharma <asharma@mvista.com>
> +
> + src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++
> + src/rpc/gendispatch.pl | 5 +++
> + 2 files changed, 70 insertions(+)
> +
> +diff --git a/src/remote/remote_daemon_dispatch.c
> b/src/remote/remote_daemon_dispatch.c
> +index aaabd1e56c..01dcac4b12 100644
> +--- a/src/remote/remote_daemon_dispatch.c
> ++++ b/src/remote/remote_daemon_dispatch.c
> +@@ -2291,6 +2291,10 @@
> remoteDispatchDomainGetSchedulerParameters(virNetServer *server
> G_GNUC_UNUSED,
> + if (!conn)
> + goto cleanup;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -2339,6 +2343,10 @@
> remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server
> G_GNUC_UNUS
> + if (!conn)
> + goto cleanup;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -2497,6 +2505,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer
> *server G_GNUC_UNUSED,
> + goto cleanup;
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -2717,6 +2729,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer
> *server G_GNUC_UNUSED,
> + if (!(dom = get_nonnull_domain(conn, args->dom)))
> + goto cleanup;
> +
> ++ if (args->ncpumaps < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> ++ if (args->maplen < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps >
> REMOTE_VCPUINFO_MAX"));
> + goto cleanup;
> +@@ -2811,6 +2831,11 @@
> remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED,
> + if (!(dom = get_nonnull_domain(conn, args->dom)))
> + goto cleanup;
> +
> ++ if (args->maplen < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> ++
> + /* Allocate buffers to take the results */
> + if (args->maplen > 0)
> + cpumaps = g_new0(unsigned char, args->maplen);
> +@@ -2858,6 +2883,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server
> G_GNUC_UNUSED,
> + if (!(dom = get_nonnull_domain(conn, args->dom)))
> + goto cleanup;
> +
> ++ if (args->maxinfo < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> ++ if (args->maplen < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo >
> REMOTE_VCPUINFO_MAX"));
> + goto cleanup;
> +@@ -3096,6 +3129,10 @@
> remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -3156,6 +3193,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer
> *server G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -3216,6 +3257,10 @@
> remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -3277,6 +3322,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server
> G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -3339,6 +3388,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer
> *server G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -3514,6 +3567,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer
> *server G_GNUC_UNUSED,
> + if (!conn)
> + goto cleanup;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -5081,6 +5138,10 @@
> remoteDispatchDomainGetInterfaceParameters(virNetServer *server
> G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +@@ -5301,6 +5362,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer
> *server G_GNUC_UNUSED,
> +
> + flags = args->flags;
> +
> ++ if (args->nparams < 0) {
> ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be
> non-negative"));
> ++ goto cleanup;
> ++ }
> + if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
> + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too
> large"));
> + goto cleanup;
> +diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
> +index 5ce988c5ae..c5842dc796 100755
> +--- a/src/rpc/gendispatch.pl
> ++++ b/src/rpc/gendispatch.pl
> +@@ -1070,6 +1070,11 @@ elsif ($mode eq "server") {
> + print "\n";
> +
> + if ($single_ret_as_list) {
> ++ print " if (args->$single_ret_list_max_var < 0) {\n";
> ++ print " virReportError(VIR_ERR_RPC,\n";
> ++ print " \"%s\",
> _(\"max$single_ret_list_name must be non-negative\"));\n";
> ++ print " goto cleanup;\n";
> ++ print " }\n";
> + print " if (args->$single_ret_list_max_var >
> $single_ret_list_max_define) {\n";
> + print " virReportError(VIR_ERR_RPC,\n";
> + print " \"%s\",
> _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
> +--
> +GitLab
> +
> diff --git a/recipes-extended/libvirt/libvirt_6.1.0.bb
> b/recipes-extended/libvirt/libvirt_6.1.0.bb
> index 6843f532..d3f875a1 100644
> --- a/recipes-extended/libvirt/libvirt_6.1.0.bb
> +++ b/recipes-extended/libvirt/libvirt_6.1.0.bb
> @@ -51,6 +51,7 @@ SRC_URI = "
> http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
> file://CVE-2022-0897.patch \
> file://CVE-2021-3975.patch \
> file://CVE-2021-4147.patch \
> + file://CVE-2024-2494.patch \
>
You have a CVE patch in your list that isn't merged into meta-virt
dunfell.
Can you send a v3 with both of those CVE patches ?
Bruce
> "
> SRC_URI[libvirt.md5sum] = "a870e63f20fac2ccf98e716d05256145"
> SRC_URI[libvirt.sha256sum] =
> "167c185be45560e73dd3e14ed375778b555c01455192de2dafc4d0f74fabebc0"
> --
> 2.24.4
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#8653):
> https://lists.yoctoproject.org/g/meta-virtualization/message/8653
> Mute This Topic: https://lists.yoctoproject.org/mt/105138979/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
--
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II
[-- Attachment #2: Type: text/html, Size: 17476 bytes --]
prev parent reply other threads:[~2024-04-09 14:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-25 14:37 [meta-virtualization][dunfell][PATCH V2] libvirt: Backport fix for CVE-2024-2494 Ashish Sharma
2024-04-09 14:01 ` Bruce Ashfield [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CADkTA4NwaG5bbZKZFK44gFufAiwi+h1qx+yET762p=L0+2G9Jw@mail.gmail.com' \
--to=bruce.ashfield@gmail.com \
--cc=asharma@mvista.com \
--cc=meta-virtualization@lists.yoctoproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).