Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package spice-vdagent for openSUSE:Factory checked in at 2026-07-26 11:27:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/spice-vdagent (Old) and /work/SRC/openSUSE:Factory/.spice-vdagent.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "spice-vdagent" Sun Jul 26 11:27:56 2026 rev:30 rq:1367700 version:0.23.0 Changes: -------- --- /work/SRC/openSUSE:Factory/spice-vdagent/spice-vdagent.changes 2026-05-30 22:54:17.702814445 +0200 +++ /work/SRC/openSUSE:Factory/.spice-vdagent.new.2004/spice-vdagent.changes 2026-07-26 11:30:01.761912205 +0200 @@ -1,0 +2,11 @@ +Fri Jul 24 11:35:30 MDT 2026 - [email protected] + +- bsc#1269553 - VUL-0: CVE-2026-57965: spice-vdagent: integer + overflow in `udscs_write()` can lead to heap buffer overflow + Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch +- bsc#1269554 - VUL-0: CVE-2026-57966: spice-vdagent: improper + sanitization allows a compromised SPICE host to write arbitrary + files to any location on the guest operating system + Reject-path-traversal-in-file-transfer-filenames.patch + +------------------------------------------------------------------- New: ---- Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch Reject-path-traversal-in-file-transfer-filenames.patch ----------(New B)---------- New: overflow in `udscs_write()` can lead to heap buffer overflow Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch - bsc#1269554 - VUL-0: CVE-2026-57966: spice-vdagent: improper New: files to any location on the guest operating system Reject-path-traversal-in-file-transfer-filenames.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ spice-vdagent.spec ++++++ --- /var/tmp/diff_new_pack.pv9ogC/_old 2026-07-26 11:30:02.357932786 +0200 +++ /var/tmp/diff_new_pack.pv9ogC/_new 2026-07-26 11:30:02.357932786 +0200 @@ -30,6 +30,8 @@ Source: http://spice-space.org/download/releases/%{name}-%{version}.tar.bz2 Source2: %{name}.keyring Patch0: harden_spice-vdagentd.service.patch +Patch1: Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch +Patch2: Reject-path-traversal-in-file-transfer-filenames.patch BuildRequires: alsa-devel >= 1.0.22 BuildRequires: desktop-file-utils BuildRequires: libXfixes-devel ++++++ Prevent-integer-overflow-in-udscs_write-buf_size-calculation.patch ++++++ Subject: fix(udscs): Prevent integer overflow in udscs_write() buf_size calculation From: Vinz Spring [email protected] Fri Jul 17 13:55:32 2026 +0000 Date: Mon Jul 20 08:34:40 2026 +0000: Git: e379398607671764b23e92cb81b7fa729ba64a3c Add a bounds check rejecting messages where size > UINT32_MAX - sizeof(header) before computing buf_size = sizeof(header) + size. This prevents the 32-bit unsigned integer wraparound that leads to a tiny allocation followed by a massive heap-buffer-overflow memcpy, crashing the daemon (DoS). CVE: CVE-2026-57965 diff --git a/src/udscs.c b/src/udscs.c index 6c50f76..4b121ff 100644 --- a/src/udscs.c +++ b/src/udscs.c @@ -141,6 +141,13 @@ void udscs_write(UdscsConnection *conn, uint32_t type, uint32_t arg1, guint buf_size; struct udscs_message_header header; + /* CVE-2026-57965: Prevent integer overflow in buf_size calculation. + * sizeof(header) + size must not wrap a 32-bit unsigned integer. */ + if (size > UINT32_MAX - sizeof(header)) { + syslog(LOG_ERR, "udscs_write: message size %u too large, dropping", size); + return; + } + buf_size = sizeof(header) + size; buf = g_malloc(buf_size); ++++++ Reject-path-traversal-in-file-transfer-filenames.patch ++++++ Subject: fix(file-xfers): Reject path traversal in file transfer filenames From: Vinz Spring [email protected] Fri Jul 17 13:55:37 2026 +0000 Date: Mon Jul 20 09:52:31 2026 +0000: Git: c2eaec460acb555d4c0ceb244a0782b50745b278 Add is_safe_filename() validation in vdagent_file_xfers_create_file() that rejects filenames containing '..' path components or absolute paths. This prevents a malicious SPICE host from writing arbitrary files outside the intended save directory via crafted file transfer names. CVE: CVE-2026-57966 diff --git a/src/vdagent/file-xfers.c b/src/vdagent/file-xfers.c index 4898fc0..2c3fac7 100644 --- a/src/vdagent/file-xfers.c +++ b/src/vdagent/file-xfers.c @@ -22,6 +22,7 @@ #include <stdio.h> #include <stdlib.h> +#include <stdbool.h> #include <inttypes.h> #include <string.h> #include <syslog.h> @@ -178,6 +179,29 @@ static uint64_t get_free_space_available(const char *path) return stat.f_bsize * stat.f_bavail; } +/* File transfers may contain relative subdirectories, but must remain below + * the configured save directory. */ +static bool +is_safe_relative_path(const char *filename) +{ + const char *component = filename; + + if (filename[0] == '\0' || g_path_is_absolute(filename)) + return false; + + while (component != NULL) { + const char *separator = strchr(component, G_DIR_SEPARATOR); + size_t length = separator != NULL ? separator - component : strlen(component); + + if (length == 2 && component[0] == '.' && component[1] == '.') + return false; + + component = separator != NULL ? separator + 1 : NULL; + } + + return true; +} + int vdagent_file_xfers_create_file(const char *save_dir, char **file_name_p) { @@ -187,6 +211,11 @@ vdagent_file_xfers_create_file(const char *save_dir, char **file_name_p) int file_fd = -1; int i; + if (!is_safe_relative_path(*file_name_p)) { + syslog(LOG_ERR, "file-xfer: rejecting unsafe filename: %s", *file_name_p); + return -1; + } + file_path = g_build_filename(save_dir, *file_name_p, NULL); dir = g_path_get_dirname(file_path); if (g_mkdir_with_parents(dir, S_IRWXU) == -1) { diff --git a/tests/test-file-xfers.c b/tests/test-file-xfers.c index 9995336..b734f91 100644 --- a/tests/test-file-xfers.c +++ b/tests/test-file-xfers.c @@ -64,6 +64,16 @@ int main(int argc, char *argv[]) // create a file in a subdirectory not existing test_file("subdir/test.txt", "./test-dir/subdir/test.txt"); + // reject paths that can escape the destination directory + test_file("../escape.txt", NULL); + test_file("subdir/../../escape.txt", NULL); + test_file("/tmp/escape.txt", NULL); + test_file("", NULL); + + // allow dots that are not parent-directory components + test_file(".hidden", "./test-dir/.hidden"); + test_file("subdir/file..txt", "./test-dir/subdir/file..txt"); + // create a file in a directory with no permissions assert(system("ln -s /proc/1 test-dir/baddir") == 0); test_file("baddir/test2.txt", NULL);
