b158f13b17
Backport the source patches from the version 7.0.0-3+deb11u3. [https://sources.debian.org/src/libvirt/7.0.0-3%2Bdeb11u3/debian/patches/] Refer to: CVE-2021-3631: https://nvd.nist.gov/vuln/detail/CVE-2021-3631 CVE-2021-3667: https://nvd.nist.gov/vuln/detail/CVE-2021-3667 CVE-2021-3975: https://nvd.nist.gov/vuln/detail/CVE-2021-3975 CVE-2021-4147: https://nvd.nist.gov/vuln/detail/CVE-2021-4147 CVE-2022-0897: https://nvd.nist.gov/vuln/detail/CVE-2022-0897 CVE-2024-1441: https://nvd.nist.gov/vuln/detail/CVE-2024-1441 CVE-2024-2494: https://nvd.nist.gov/vuln/detail/CVE-2024-2494 CVE-2024-2496: https://nvd.nist.gov/vuln/detail/CVE-2024-2496 Test Plan: Pass: downloader Pass: build-pkgs --clean --all Pass: build-image Pass: Debian AIO jenkins installation Closes-Bug: 2078664 Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Change-Id: Ic2c0d6a8208b18ec4d1db2c07fc1fb2508cef183
49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
From: Daniel P. Berrangé <berrange@redhat.com>
|
|
Date: Tue, 8 Mar 2022 17:28:38 +0000
|
|
Subject: nwfilter: fix crash when counting number of network filters
|
|
|
|
The virNWFilterObjListNumOfNWFilters method iterates over the
|
|
driver->nwfilters, accessing virNWFilterObj instances. As such
|
|
it needs to be protected against concurrent modification of
|
|
the driver->nwfilters object.
|
|
|
|
This API allows unprivileged users to connect, so users with
|
|
read-only access to libvirt can cause a denial of service
|
|
crash if they are able to race with a call of virNWFilterUndefine.
|
|
Since network filters are usually statically defined, this is
|
|
considered a low severity problem.
|
|
|
|
This is assigned CVE-2022-0897.
|
|
|
|
Reviewed-by: Eric Blake <eblake@redhat.com>
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Origin: https://gitlab.com/libvirt/libvirt/-/commit/a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36
|
|
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2022-0897
|
|
Bug-Debian: https://bugs.debian.org/1009075
|
|
---
|
|
src/nwfilter/nwfilter_driver.c | 8 ++++++--
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
|
|
index 1b8e3db..4b09518 100644
|
|
--- a/src/nwfilter/nwfilter_driver.c
|
|
+++ b/src/nwfilter/nwfilter_driver.c
|
|
@@ -478,11 +478,15 @@ nwfilterLookupByName(virConnectPtr conn,
|
|
static int
|
|
nwfilterConnectNumOfNWFilters(virConnectPtr conn)
|
|
{
|
|
+ int ret;
|
|
if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
|
|
return -1;
|
|
|
|
- return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
|
|
- virConnectNumOfNWFiltersCheckACL);
|
|
+ nwfilterDriverLock();
|
|
+ ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
|
|
+ virConnectNumOfNWFiltersCheckACL);
|
|
+ nwfilterDriverUnlock();
|
|
+ return ret;
|
|
}
|
|
|
|
|