Hello community, here is the log from the commit of package libvirt for openSUSE:Factory checked in at 2014-09-23 10:46:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libvirt (Old) and /work/SRC/openSUSE:Factory/.libvirt.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libvirt" Changes: -------- --- /work/SRC/openSUSE:Factory/libvirt/libvirt.changes 2014-09-18 08:02:15.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.libvirt.new/libvirt.changes 2014-09-23 10:46:44.000000000 +0200 @@ -1,0 +2,8 @@ +Thu Sep 18 22:42:38 MDT 2014 - [email protected] + +- CVE-2014-3633: Use correct definition when looking up disk in + qemu blkiotune + 3e745e8f-CVE-2014-3633.patch + bnc#897783 + +------------------------------------------------------------------- New: ---- 3e745e8f-CVE-2014-3633.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libvirt.spec ++++++ --- /var/tmp/diff_new_pack.UTynEN/_old 2014-09-23 10:46:46.000000000 +0200 +++ /var/tmp/diff_new_pack.UTynEN/_new 2014-09-23 10:46:46.000000000 +0200 @@ -429,6 +429,7 @@ Source2: libvirtd-relocation-server.fw Source99: baselibs.conf # Upstream patches +Patch0: 3e745e8f-CVE-2014-3633.patch # Patches pending upstream review Patch100: libvirt-guests-wait-for-ntp.patch # Need to go upstream @@ -950,6 +951,7 @@ %prep %setup -q +%patch0 -p1 %patch100 -p1 %patch150 -p1 %patch151 -p1 ++++++ 3e745e8f-CVE-2014-3633.patch ++++++ commit 3e745e8f775dfe6f64f18b5c2fe4791b35d3546b Author: Peter Krempa <[email protected]> Date: Thu Sep 11 16:35:53 2014 +0200 CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk Live definition was used to look up the disk index while persistent one was indexed leading to a crash in qemuDomainGetBlockIoTune. Use the correct def and report a nice error. Unfortunately it's accessible via read-only connection, though it can only crash libvirtd in the cases where the guest is hot-plugging disks without reflecting those changes to the persistent definition. So avoiding hotplug, or doing hotplug where persistent is always modified alongside live definition, will avoid the out-of-bounds access. Introduced in: eca96694a7f992be633d48d5ca03cedc9bbc3c9aa (v0.9.8) Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1140724 Reported-by: Luyao Huang <[email protected]> Signed-off-by: Peter Krempa <[email protected]> Index: libvirt-1.2.8/src/qemu/qemu_driver.c =================================================================== --- libvirt-1.2.8.orig/src/qemu/qemu_driver.c +++ libvirt-1.2.8/src/qemu/qemu_driver.c @@ -16141,9 +16141,13 @@ qemuDomainGetBlockIoTune(virDomainPtr do } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - int idx = virDomainDiskIndexByName(vm->def, disk, true); - if (idx < 0) + int idx = virDomainDiskIndexByName(persistentDef, disk, true); + if (idx < 0) { + virReportError(VIR_ERR_INVALID_ARG, + _("disk '%s' was not found in the domain config"), + disk); goto endjob; + } reply = persistentDef->disks[idx]->blkdeviotune; } -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
