[libvirt] [PATCH] CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats()

[Martin Kletzander]

On Wed, Dec 10, 2014 at 10:18:08AM -0700, Eric Blake wrote:
>On 12/10/2014 01:25 AM, Martin Kletzander wrote:
>> When user doesn't have read access on one of the domains he requested,
>> the for loop could exit abruptly or continue and override pointer which
>> pointed to locked object.
>>
>> This patch fixed two issues at once.  One is that domflags might have
>> had QEMU_DOMAIN_STATS_HAVE_JOB even when there was no job started (this
>> is fixed by doing domflags |= QEMU_DOMAIN_STATS_HAVE_JOB only when the
>> job was acquired and cleaning domflags on every start of the loop.
>> Second one is that the domain is kept locked when
>> virConnectGetAllDomainStatsCheckACL() fails and continues the loop when
>> it didn't end.  Adding a simple virObjectUnlock() and clearing the
>> pointer ought to do.
>>
>> Signed-off-by: Martin Kletzander <mkletzan at redhat.com>
>> ---
>>
>> Since this is very low priority and it was mistakenly disclosed in
>> another patch there is no embargo on this CVE.  Patches to maint
>> branches will be pushed after back-porting (couple of minutes).
>>
>> Having said that, I am probably not the right one to write up the
>> libvirt security notice, but I'll try drafting one, eventually.
>
>I can help with the security notices, as we have several other CVEs that
>will also be plugged in time for 1.2.11.
>

That would be great.  Just to complete this info, there's one
additional patch that's needed for this CVE fix to be complete:

commit cb104ef734dfea12cb8826dba7e2c98912c4b7e1
Refs: v1.2.11-rc2-2-gcb104ef
Author:     Francesco Romani <fromani at redhat.com>
AuthorDate: Thu Dec 11 08:44:09 2014 +0100
Commit:     Peter Krempa <pkrempa at redhat.com>
CommitDate: Thu Dec 11 11:02:05 2014 +0100

    qemu: bulk stats: Fix logic in monitor handling

Let me know if I should back-port it with 'CVE-2014-8131' prefix or
just as it is.

Thank you,
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20141211/d83105f5/attachment-0001.sig>