b158f13b17
Backport the source patches from the version 7.0.0-3+deb11u3. [https://sources.debian.org/src/libvirt/7.0.0-3%2Bdeb11u3/debian/patches/] Refer to: CVE-2021-3631: https://nvd.nist.gov/vuln/detail/CVE-2021-3631 CVE-2021-3667: https://nvd.nist.gov/vuln/detail/CVE-2021-3667 CVE-2021-3975: https://nvd.nist.gov/vuln/detail/CVE-2021-3975 CVE-2021-4147: https://nvd.nist.gov/vuln/detail/CVE-2021-4147 CVE-2022-0897: https://nvd.nist.gov/vuln/detail/CVE-2022-0897 CVE-2024-1441: https://nvd.nist.gov/vuln/detail/CVE-2024-1441 CVE-2024-2494: https://nvd.nist.gov/vuln/detail/CVE-2024-2494 CVE-2024-2496: https://nvd.nist.gov/vuln/detail/CVE-2024-2496 Test Plan: Pass: downloader Pass: build-pkgs --clean --all Pass: build-image Pass: Debian AIO jenkins installation Closes-Bug: 2078664 Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Change-Id: Ic2c0d6a8208b18ec4d1db2c07fc1fb2508cef183
36 lines
1.4 KiB
Diff
36 lines
1.4 KiB
Diff
From: Martin Kletzander <mkletzan@redhat.com>
|
|
Date: Tue, 27 Feb 2024 16:20:12 +0100
|
|
Subject: Fix off-by-one error in udevListInterfacesByStatus
|
|
|
|
Ever since this function was introduced in 2012 it could've tried
|
|
filling in an extra interface name. That was made worse in 2019 when
|
|
the caller functions started accepting NULL arrays of size 0.
|
|
|
|
This is assigned CVE-2024-1441.
|
|
|
|
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
|
|
Reported-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
|
|
Fixes: 5a33366f5c0b18c93d161bd144f9f079de4ac8ca
|
|
Fixes: d6064e2759a24e0802f363e3a810dc5a7d7ebb15
|
|
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
Origin: https://gitlab.com/libvirt/libvirt/-/commit/c664015fe3a7bf59db26686e9ed69af011c6ebb8
|
|
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2024-1441
|
|
Bug-Debian: https://bugs.debian.org/1066058
|
|
---
|
|
src/interface/interface_backend_udev.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
|
|
index 6a94a45..65a5244 100644
|
|
--- a/src/interface/interface_backend_udev.c
|
|
+++ b/src/interface/interface_backend_udev.c
|
|
@@ -221,7 +221,7 @@ udevListInterfacesByStatus(virConnectPtr conn,
|
|
virInterfaceDefPtr def;
|
|
|
|
/* Ensure we won't exceed the size of our array */
|
|
- if (count > names_len)
|
|
+ if (count >= names_len)
|
|
break;
|
|
|
|
path = udev_list_entry_get_name(dev_entry);
|