[libvirt] CVE-2013-4153, CVE-2013-4154

[Eric Blake]

Two CVEs have been assigned for recent patches both related to 'virsh
vcpucount'.  I have backported these patches to v1.1.0-maint (the only
release impacted by either bug).

CVE-2013-4153 was introduced by commit v1.0.6-48-gc6afcb0, and could
allow a read-only client to cause a double free in libvirtd on a domain
that has an active guest agent.

CVE-2013-4154 was introduced by commit v1.0.6-47-g29c1e91, and could
allow a read-only client to cause libvirtd to crash on a domain without
a guest agent.

commit dfc692350a04a70b4ca65667c30869b3bfdaf034
Author: Peter Krempa <pkrempa at redhat.com>
Date:   Tue Jul 16 15:39:06 2013 +0200

    qemu: Fix double free of returned JSON array in qemuAgentGetVCPUs()

    A part of the returned monitor response was freed twice and caused
    crashes of the daemon when using guest agent cpu count retrieval.

     # virsh vcpucount dom --guest

    Introduced in v1.0.6-48-gc6afcb0

commit 96518d4316b711c72205117f8d5c967d5127bbb6
Author: Alex Jia <ajia at redhat.com>
Date:   Tue Jul 16 17:30:20 2013 +0800

    qemu: Prevent crash of libvirtd without guest agent configuration

    If users haven't configured guest agent then qemuAgentCommand() will
    dereference a NULL 'mon' pointer, which causes crash of libvirtd when
    using agent based cpu (un)plug.

    With the patch, when the qemu-ga service isn't running in the guest,
    a expected error "error: Guest agent is not responding: Guest agent
    not available for now" will be raised, and the error "error: argument
    unsupported: QEMU guest agent is not configured" is raised when the
    guest hasn't configured guest agent.

    GDB backtrace:

     (gdb) bt
     #0  virNetServerFatalSignal (sig=11, siginfo=<value optimized out>,
context=<value optimized out>) at rpc/virnetserver.c:326
     #1  <signal handler called>
     #2  qemuAgentCommand (mon=0x0, cmd=0x7f39300017b0,
reply=0x7f394b090910, seconds=-2) at qemu/qemu_agent.c:975
     #3  0x00007f39429507f6 in qemuAgentGetVCPUs (mon=0x0,
info=0x7f394b0909b8) at qemu/qemu_agent.c:1475
     #4  0x00007f39429d9857 in qemuDomainGetVcpusFlags (dom=<value
optimized out>, flags=9) at qemu/qemu_driver.c:4849
     #5  0x00007f3957dffd8d in virDomainGetVcpusFlags
(domain=0x7f39300009c0, flags=8) at libvirt.c:9843

    How to reproduce?

     # To start a guest without guest agent configuration
     # then run the following cmdline

     # virsh vcpucount foobar --guest
     error: End of file while reading data: Input/output error
     error: One or more references were leaked after disconnect from the
hypervisor
     error: Failed to reconnect to the hypervisor

    RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=984821

    Signed-off-by: Alex Jia <ajia at redhat.com>
    Signed-off-by: Peter Krempa <pkrempa at redhat.com>


-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130719/1bd20389/attachment-0001.sig>