Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=21b92ba158d3e6fcfeea8cd4ecfc7d5d1d85443c
commit 21b92ba158d3e6fcfeea8cd4ecfc7d5d1d85443c Author: kikadf <[email protected]> Date: Wed Dec 10 10:46:37 2014 +0100 libvirt-1.2.9-2-x86_64 * Fix CVE-2014-7823 diff --git a/source/xlib-extra/libvirt/CVE-2014-7823.patch b/source/xlib-extra/libvirt/CVE-2014-7823.patch new file mode 100644 index 0000000..c9c46da --- /dev/null +++ b/source/xlib-extra/libvirt/CVE-2014-7823.patch @@ -0,0 +1,62 @@ +Backport of: + +From b1674ad5a97441b7e1bd5f5ebaff498ef2fbb11b Mon Sep 17 00:00:00 2001 +From: Eric Blake <[email protected]> +Date: Fri, 31 Oct 2014 22:14:07 -0600 +Subject: [PATCH] CVE-2014-7823: dumpxml: security hole with migratable flag + +Commit 28f8dfd (v1.0.0) introduced a security hole: in at least +the qemu implementation of virDomainGetXMLDesc, the use of the +flag VIR_DOMAIN_XML_MIGRATABLE (which is usable from a read-only +connection) triggers the implicit use of VIR_DOMAIN_XML_SECURE +prior to calling qemuDomainFormatXML. However, the use of +VIR_DOMAIN_XML_SECURE is supposed to be restricted to read-write +clients only. This patch treats the migratable flag as requiring +the same permissions, rather than analyzing what might break if +migratable xml no longer includes secret information. + +Fortunately, the information leak is low-risk: all that is gated +by the VIR_DOMAIN_XML_SECURE flag is the VNC connection password; +but VNC passwords are already weak (FIPS forbids their use, and +on a non-FIPS machine, anyone stupid enough to trust a max-8-byte +password sent in plaintext over the network deserves what they +get). SPICE offers better security than VNC, and all other +secrets are properly protected by use of virSecret associations +rather than direct output in domain XML. + +* src/remote/remote_protocol.x (REMOTE_PROC_DOMAIN_GET_XML_DESC): +Tighten rules on use of migratable flag. +* src/libvirt-domain.c (virDomainGetXMLDesc): Likewise. + +Signed-off-by: Eric Blake <[email protected]> +--- + src/libvirt-domain.c | 3 ++- + src/remote/remote_protocol.x | 1 + + 2 files changed, 3 insertions(+), 1 deletions(-) + +Index: libvirt-1.2.8/src/libvirt.c +=================================================================== +--- libvirt-1.2.8.orig/src/libvirt.c 2014-11-10 13:34:17.916556117 -0500 ++++ libvirt-1.2.8/src/libvirt.c 2014-11-10 13:35:48.097723569 -0500 +@@ -4373,7 +4373,8 @@ + virCheckDomainReturn(domain, NULL); + conn = domain->conn; + +- if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) { ++ if ((conn->flags & VIR_CONNECT_RO) && ++ (flags & (VIR_DOMAIN_XML_SECURE | VIR_DOMAIN_XML_MIGRATABLE))) { + virReportError(VIR_ERR_OPERATION_DENIED, "%s", + _("virDomainGetXMLDesc with secure flag")); + goto error; +Index: libvirt-1.2.8/src/remote/remote_protocol.x +=================================================================== +--- libvirt-1.2.8.orig/src/remote/remote_protocol.x 2014-08-29 08:22:31.000000000 -0400 ++++ libvirt-1.2.8/src/remote/remote_protocol.x 2014-11-10 13:36:23.526188341 -0500 +@@ -3224,6 +3224,7 @@ + * @generate: both + * @acl: domain:read + * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE ++ * @acl: domain:read_secure:VIR_DOMAIN_XML_MIGRATABLE + */ + REMOTE_PROC_DOMAIN_GET_XML_DESC = 14, + diff --git a/source/xlib-extra/libvirt/FrugalBuild b/source/xlib-extra/libvirt/FrugalBuild index b1e85d0..664c09b 100644 --- a/source/xlib-extra/libvirt/FrugalBuild +++ b/source/xlib-extra/libvirt/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=libvirt pkgver=1.2.9 -pkgrel=1 +pkgrel=2 pkgdesc="libvirt is a library providing access to information from various virtualization tools" url="http://libvirt.org"; depends=('libxml2' 'gnutls>=3.2.12.1' 'cyrus-sasl' 'parted>=3.1' \ @@ -28,6 +28,13 @@ Fconfopts+=" --with-udev --with-avahi --with-init-script=systemd" _F_systemd_units=(libvirtd= libvirt-guests=) Finclude systemd +# FSA fix *** +# will fix in 1.2.11 +source=(${source[@]} CVE-2014-7823.patch) +sha1sums=(${sha1sums[@]} '4638e633e89a7fa4b94f0e8fb91520ad49576701') +# *********** + + build() { Fcd Fpatchall _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
