commit: 3c32491d0bcded18663dd976934ad5c10b29d4c2 Author: Michal Privoznik <michal.privoznik <AT> gmail <DOT> com> AuthorDate: Sat Apr 13 18:53:12 2024 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Sun Apr 14 00:41:53 2024 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3c32491d
app-emulation/libvirt: Backport fix for CVE-2024-2494 The fix made it into app-emulation/libvirt-10.2.0 release. Backport the fix into anything older. https://nvd.nist.gov/vuln/detail/CVE-2024-2494 Bug: https://bugs.gentoo.org/929966 Signed-off-by: Michal Privoznik <michal.privoznik <AT> gmail.com> Closes: https://github.com/gentoo/gentoo/pull/36242 Signed-off-by: Sam James <sam <AT> gentoo.org> ...k-for-negative-array-lengths-before-alloc.patch | 222 +++++++++++++++++++++ ...t-10.0.0-r1.ebuild => libvirt-10.0.0-r2.ebuild} | 1 + ...virt-10.1.0.ebuild => libvirt-10.1.0-r1.ebuild} | 1 + ...irt-9.8.0-r1.ebuild => libvirt-9.8.0-r2.ebuild} | 1 + ...irt-9.9.0-r1.ebuild => libvirt-9.9.0-r2.ebuild} | 1 + 5 files changed, 226 insertions(+) diff --git a/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch b/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch new file mode 100644 index 000000000000..3e0426634f42 --- /dev/null +++ b/app-emulation/libvirt/files/libvirt-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch @@ -0,0 +1,222 @@ +From 10fa5f6ba64b354b99b0f7b372e66e45bb4d9379 Mon Sep 17 00:00:00 2001 +Message-ID: <10fa5f6ba64b354b99b0f7b372e66e45bb4d9379.1713033988.git.mpriv...@redhat.com> +In-Reply-To: <2127032ed8cd49001465dc0dce9f842e13467bc2.1713033988.git.mpriv...@redhat.com> +References: <2127032ed8cd49001465dc0dce9f842e13467bc2.1713033988.git.mpriv...@redhat.com> +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <[email protected]> +Date: Fri, 15 Mar 2024 10:47:50 +0000 +Subject: [PATCH 2/2] remote: check for negative array lengths before + allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +While the C API entry points will validate non-negative lengths +for various parameters, the RPC server de-serialization code +will need to allocate memory for arrays before entering the C +API. These allocations will thus happen before the non-negative +length check is performed. + +Passing a negative length to the g_new0 function will usually +result in a crash due to the negative length being treated as +a huge positive number. + +This was found and diagnosed by ALT Linux Team with AFLplusplus. + +CVE-2024-2494 +Reviewed-by: Michal Privoznik <[email protected]> +Found-by: Alexandr Shashkin <[email protected]> +Co-developed-by: Alexander Kuznetsov <[email protected]> +Signed-off-by: Daniel P. Berrangé <[email protected]> +(cherry picked from commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2) +Signed-off-by: Michal Privoznik <[email protected]> +--- + src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++ + src/rpc/gendispatch.pl | 5 +++ + 2 files changed, 70 insertions(+) + +diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c +index 7daf503b51..7542caa952 100644 +--- a/src/remote/remote_daemon_dispatch.c ++++ b/src/remote/remote_daemon_dispatch.c +@@ -2291,6 +2291,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2339,6 +2343,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2497,6 +2505,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED, + goto cleanup; + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -2717,6 +2729,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->ncpumaps < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative")); ++ goto cleanup; ++ } ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); ++ goto cleanup; ++ } + if (args->ncpumaps > REMOTE_VCPUINFO_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX")); + goto cleanup; +@@ -2811,6 +2831,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative")); ++ goto cleanup; ++ } ++ + /* Allocate buffers to take the results */ + if (args->maplen > 0) + cpumaps = g_new0(unsigned char, args->maplen); +@@ -2858,6 +2883,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED, + if (!(dom = get_nonnull_domain(conn, args->dom))) + goto cleanup; + ++ if (args->maxinfo < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); ++ goto cleanup; ++ } ++ if (args->maplen < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative")); ++ goto cleanup; ++ } + if (args->maxinfo > REMOTE_VCPUINFO_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX")); + goto cleanup; +@@ -3096,6 +3129,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3156,6 +3193,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3216,6 +3257,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3277,6 +3322,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3339,6 +3388,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -3514,6 +3567,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -5079,6 +5136,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +@@ -5299,6 +5360,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED, + + flags = args->flags; + ++ if (args->nparams < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative")); ++ goto cleanup; ++ } + if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; +diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl +index fa45d15a92..294e21f8a1 100755 +--- a/src/rpc/gendispatch.pl ++++ b/src/rpc/gendispatch.pl +@@ -1070,6 +1070,11 @@ elsif ($mode eq "server") { + print "\n"; + + if ($single_ret_as_list) { ++ print " if (args->$single_ret_list_max_var < 0) {\n"; ++ print " virReportError(VIR_ERR_RPC,\n"; ++ print " \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n"; ++ print " goto cleanup;\n"; ++ print " }\n"; + print " if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n"; + print " virReportError(VIR_ERR_RPC,\n"; + print " \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n"; +-- +2.43.2 + diff --git a/app-emulation/libvirt/libvirt-10.0.0-r1.ebuild b/app-emulation/libvirt/libvirt-10.0.0-r2.ebuild similarity index 99% rename from app-emulation/libvirt/libvirt-10.0.0-r1.ebuild rename to app-emulation/libvirt/libvirt-10.0.0-r2.ebuild index 0f5860138006..baf260598704 100644 --- a/app-emulation/libvirt/libvirt-10.0.0-r1.ebuild +++ b/app-emulation/libvirt/libvirt-10.0.0-r2.ebuild @@ -148,6 +148,7 @@ PATCHES=( "${FILESDIR}"/${PN}-9.9.0-do-not-use-sysconfig.patch "${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch "${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch + "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch ) pkg_setup() { diff --git a/app-emulation/libvirt/libvirt-10.1.0.ebuild b/app-emulation/libvirt/libvirt-10.1.0-r1.ebuild similarity index 99% rename from app-emulation/libvirt/libvirt-10.1.0.ebuild rename to app-emulation/libvirt/libvirt-10.1.0-r1.ebuild index f1c08714d713..128f76475972 100644 --- a/app-emulation/libvirt/libvirt-10.1.0.ebuild +++ b/app-emulation/libvirt/libvirt-10.1.0-r1.ebuild @@ -147,6 +147,7 @@ PATCHES=( "${FILESDIR}"/${PN}-9.4.0-fix_paths_in_libvirt-guests_sh.patch "${FILESDIR}"/${PN}-9.9.0-do-not-use-sysconfig.patch "${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch + "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch ) pkg_setup() { diff --git a/app-emulation/libvirt/libvirt-9.8.0-r1.ebuild b/app-emulation/libvirt/libvirt-9.8.0-r2.ebuild similarity index 99% rename from app-emulation/libvirt/libvirt-9.8.0-r1.ebuild rename to app-emulation/libvirt/libvirt-9.8.0-r2.ebuild index 899d7683f299..500ab7f572ad 100644 --- a/app-emulation/libvirt/libvirt-9.8.0-r1.ebuild +++ b/app-emulation/libvirt/libvirt-9.8.0-r2.ebuild @@ -148,6 +148,7 @@ PATCHES=( "${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch "${FILESDIR}"/${PN}-9.10.0-virxml-include-libxml-xmlsave.h-for-xmlIndentTreeOut.patch "${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch + "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch ) pkg_setup() { diff --git a/app-emulation/libvirt/libvirt-9.9.0-r1.ebuild b/app-emulation/libvirt/libvirt-9.9.0-r2.ebuild similarity index 99% rename from app-emulation/libvirt/libvirt-9.9.0-r1.ebuild rename to app-emulation/libvirt/libvirt-9.9.0-r2.ebuild index 8f39ada3c36b..684c0dc7afe2 100644 --- a/app-emulation/libvirt/libvirt-9.9.0-r1.ebuild +++ b/app-emulation/libvirt/libvirt-9.9.0-r2.ebuild @@ -149,6 +149,7 @@ PATCHES=( "${FILESDIR}"/${PN}-9.6.0-fix-paths-for-apparmor.patch "${FILESDIR}"/${PN}-9.10.0-virxml-include-libxml-xmlsave.h-for-xmlIndentTreeOut.patch "${FILESDIR}"/${PN}-10.1.0-Fix-off-by-one-error-in-udevListInterfacesByStatus.patch + "${FILESDIR}"/${PN}-10.2.0-remote-check-for-negative-array-lengths-before-alloc.patch ) pkg_setup() {
