From: "Sam James" <sam@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] repo/gentoo:master commit in: app-emulation/libvirt/, app-emulation/libvirt/files/
Date: Sun, 14 Apr 2024 00:43:18 +0000 (UTC) [thread overview]
Message-ID: <1713055313.3c32491d0bcded18663dd976934ad5c10b29d4c2.sam@gentoo> (raw)
commit: 3c32491d0bcded18663dd976934ad5c10b29d4c2
Author: Michal Privoznik <michal.privoznik <AT> gmail <DOT> com>
AuthorDate: Sat Apr 13 18:53:12 2024 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Apr 14 00:41:53 2024 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3c32491d
app-emulation/libvirt: Backport fix for CVE-2024-2494
The fix made it into app-emulation/libvirt-10.2.0 release.
Backport the fix into anything older.
https://nvd.nist.gov/vuln/detail/CVE-2024-2494
Bug: https://bugs.gentoo.org/929966
Signed-off-by: Michal Privoznik <michal.privoznik <AT> gmail.com>
Closes: https://github.com/gentoo/gentoo/pull/36242
Signed-off-by: Sam James <sam <AT> gentoo.org>
...k-for-negative-array-lengths-before-alloc.patch | 222 +++++++++++++++++++++
...t-10.0.0-r1.ebuild => libvirt-10.0.0-r2.ebuild} | 1 +
...virt-10.1.0.ebuild => libvirt-10.1.0-r1.ebuild} | 1 +
...irt-9.8.0-r1.ebuild => libvirt-9.8.0-r2.ebuild} | 1 +
...irt-9.9.0-r1.ebuild => libvirt-9.9.0-r2.ebuild} | 1 +
5 files changed, 226 insertions(+)
diff --git a/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch b/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
new file mode 100644
index 000000000000..3e0426634f42
--- /dev/null
+++ b/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
@@ -0,0 +1,222 @@
+From 10fa5f6ba64b354b99b0f7b372e66e45bb4d9379 Mon Sep 17 00:00:00 2001
+Message-ID: <10fa5f6ba64b354b99b0f7b372e66e45bb4d9379.1713033988.git.mprivozn@redhat.com>
+In-Reply-To: <2127032ed8cd49001465dc0dce9f842e13467bc2.1713033988.git.mprivozn@redhat.com>
+References: <2127032ed8cd49001465dc0dce9f842e13467bc2.1713033988.git.mprivozn@redhat.com>
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Fri, 15 Mar 2024 10:47:50 +0000
+Subject: [PATCH 2/2] remote: check for negative array lengths before
+ allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While the C API entry points will validate non-negative lengths
+for various parameters, the RPC server de-serialization code
+will need to allocate memory for arrays before entering the C
+API. These allocations will thus happen before the non-negative
+length check is performed.
+
+Passing a negative length to the g_new0 function will usually
+result in a crash due to the negative length being treated as
+a huge positive number.
+
+This was found and diagnosed by ALT Linux Team with AFLplusplus.
+
+CVE-2024-2494
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
+Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2)
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++
+ src/rpc/gendispatch.pl | 5 +++
+ 2 files changed, 70 insertions(+)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index 7daf503b51..7542caa952 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -2291,6 +2291,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED,
+ if (!conn)
+ goto cleanup;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -2339,6 +2343,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS
+ if (!conn)
+ goto cleanup;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -2497,6 +2505,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED,
+ goto cleanup;
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -2717,6 +2729,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED,
+ if (!(dom = get_nonnull_domain(conn, args->dom)))
+ goto cleanup;
+
++ if (args->ncpumaps < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
++ goto cleanup;
++ }
++ if (args->maplen < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
++ goto cleanup;
++ }
+ if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
+ goto cleanup;
+@@ -2811,6 +2831,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED,
+ if (!(dom = get_nonnull_domain(conn, args->dom)))
+ goto cleanup;
+
++ if (args->maplen < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
++ goto cleanup;
++ }
++
+ /* Allocate buffers to take the results */
+ if (args->maplen > 0)
+ cpumaps = g_new0(unsigned char, args->maplen);
+@@ -2858,6 +2883,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED,
+ if (!(dom = get_nonnull_domain(conn, args->dom)))
+ goto cleanup;
+
++ if (args->maxinfo < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
++ goto cleanup;
++ }
++ if (args->maplen < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
++ goto cleanup;
++ }
+ if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
+ goto cleanup;
+@@ -3096,6 +3129,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -3156,6 +3193,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -3216,6 +3257,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -3277,6 +3322,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -3339,6 +3388,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -3514,6 +3567,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED,
+ if (!conn)
+ goto cleanup;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -5079,6 +5136,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+@@ -5299,6 +5360,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
+
+ flags = args->flags;
+
++ if (args->nparams < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++ goto cleanup;
++ }
+ if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+ goto cleanup;
+diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
+index fa45d15a92..294e21f8a1 100755
+--- a/src/rpc/gendispatch.pl
++++ b/src/rpc/gendispatch.pl
+@@ -1070,6 +1070,11 @@ elsif ($mode eq "server") {
+ print "\n";
+
+ if ($single_ret_as_list) {
++ print " if (args->$single_ret_list_max_var < 0) {\n";
++ print " virReportError(VIR_ERR_RPC,\n";
++ print " \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
++ print " goto cleanup;\n";
++ print " }\n";
+ print " if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
+ print " virReportError(VIR_ERR_RPC,\n";
+ print " \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
+--
+2.43.2
+
diff --git a/app-emulation/libvirt/libvirt-10.0.0-r1.ebuild b/app-emulation/libvirt/libvirt-10.0.0-r2.ebuild
similarity index 99%
rename from app-emulation/libvirt/libvirt-10.0.0-r1.ebuild
rename to app-emulation/libvirt/libvirt-10.0.0-r2.ebuild
index 0f5860138006..baf260598704 100644
--- a/app-emulation/libvirt/libvirt-10.0.0-r1.ebuild
+++ b/app-emulation/libvirt/libvirt-10.0.0-r2.ebuild
@@ -148,6 +148,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-9.9.0-do-not-use-sysconfig.patch
"${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch
"${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch
+ "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
)
pkg_setup() {
diff --git a/app-emulation/libvirt/libvirt-10.1.0.ebuild b/app-emulation/libvirt/libvirt-10.1.0-r1.ebuild
similarity index 99%
rename from app-emulation/libvirt/libvirt-10.1.0.ebuild
rename to app-emulation/libvirt/libvirt-10.1.0-r1.ebuild
index f1c08714d713..128f76475972 100644
--- a/app-emulation/libvirt/libvirt-10.1.0.ebuild
+++ b/app-emulation/libvirt/libvirt-10.1.0-r1.ebuild
@@ -147,6 +147,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-9.4.0-fix_paths_in_libvirt-guests_sh.patch
"${FILESDIR}"/${PN}-9.9.0-do-not-use-sysconfig.patch
"${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch
+ "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
)
pkg_setup() {
diff --git a/app-emulation/libvirt/libvirt-9.8.0-r1.ebuild b/app-emulation/libvirt/libvirt-9.8.0-r2.ebuild
similarity index 99%
rename from app-emulation/libvirt/libvirt-9.8.0-r1.ebuild
rename to app-emulation/libvirt/libvirt-9.8.0-r2.ebuild
index 899d7683f299..500ab7f572ad 100644
--- a/app-emulation/libvirt/libvirt-9.8.0-r1.ebuild
+++ b/app-emulation/libvirt/libvirt-9.8.0-r2.ebuild
@@ -148,6 +148,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch
"${FILESDIR}"/${PN}-9.10.0-virxml-include-libxml-xmlsave.h-for-xmlIndentTreeOut.patch
"${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch
+ "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
)
pkg_setup() {
diff --git a/app-emulation/libvirt/libvirt-9.9.0-r1.ebuild b/app-emulation/libvirt/libvirt-9.9.0-r2.ebuild
similarity index 99%
rename from app-emulation/libvirt/libvirt-9.9.0-r1.ebuild
rename to app-emulation/libvirt/libvirt-9.9.0-r2.ebuild
index 8f39ada3c36b..684c0dc7afe2 100644
--- a/app-emulation/libvirt/libvirt-9.9.0-r1.ebuild
+++ b/app-emulation/libvirt/libvirt-9.9.0-r2.ebuild
@@ -149,6 +149,7 @@ PATCHES=(
"${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch
"${FILESDIR}"/${PN}-9.10.0-virxml-include-libxml-xmlsave.h-for-xmlIndentTreeOut.patch
"${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch
+ "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch
)
pkg_setup() {
next reply other threads:[~2024-04-14 0:43 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-14 0:43 Sam James [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-02-08 1:33 [gentoo-commits] repo/gentoo:master commit in: app-emulation/libvirt/, app-emulation/libvirt/files/ Sam James
2025-02-08 1:33 Sam James
2024-04-14 0:43 Sam James
2024-03-04 10:28 Sam James
2024-02-29 0:22 Sam James
2023-10-31 16:25 Matthias Maier
2023-06-21 21:48 Matthias Maier
2023-06-18 1:54 Matthias Maier
2023-06-10 16:59 Sam James
2022-09-23 1:06 Sam James
2022-08-03 18:21 Sam James
2022-03-02 17:36 Joonas Niilola
2022-02-21 23:14 Sam James
2022-01-04 16:33 Matthias Maier
2021-04-04 17:49 Matthias Maier
2020-12-07 8:53 Sergei Trofimovich
2020-11-10 0:34 Matthias Maier
2020-07-21 18:11 Marek Szuba
2020-04-06 17:46 Matthias Maier
2020-04-05 17:19 Matthias Maier
2020-03-15 21:14 Matthias Maier
2020-02-06 15:52 Matthias Maier
2020-02-03 3:07 Matthias Maier
2019-08-05 15:03 Matthias Maier
2019-07-09 19:06 Matthias Maier
2019-07-09 18:54 Matthias Maier
2019-07-01 15:07 Matthias Maier
2019-07-01 14:27 Matthias Maier
2019-05-19 23:42 Matthias Maier
2019-03-17 7:27 Matthias Maier
2018-12-26 3:27 Matthias Maier
2018-08-19 19:08 Matthias Maier
2018-07-03 15:30 Matthias Maier
2018-06-29 4:50 Matthias Maier
2018-06-29 4:50 Matthias Maier
2018-03-23 14:16 Matthias Maier
2017-12-07 16:08 Matthias Maier
2017-09-01 2:01 Matthias Maier
2017-09-01 2:01 Matthias Maier
2017-05-06 18:27 Matthias Maier
2017-01-22 15:34 Matthias Maier
2016-07-09 15:10 Matthias Maier
2016-06-30 18:02 Matthias Maier
2016-05-01 19:15 Matthias Maier
2016-03-11 7:45 Matthias Maier
2016-01-07 8:18 Matthias Maier
2015-12-22 16:13 Matthias Maier
2015-10-05 6:32 Matthias Maier
2015-08-14 3:48 Matthias Maier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1713055313.3c32491d0bcded18663dd976934ad5c10b29d4c2.sam@gentoo \
--to=sam@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox