From 7c5684877d834826b114e876bf656b20c76a15af Mon Sep 17 00:00:00 2001 From: mgb01105731 Date: Fri, 5 Jul 2024 10:16:37 +0800 Subject: [PATCH] fix CVE-2024-4418 --- 0001-fix-CVE-2024-4418.patch | 44 ++++++++++++++++++++++++++++++++++++ libvirt.spec | 7 +++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 0001-fix-CVE-2024-4418.patch diff --git a/0001-fix-CVE-2024-4418.patch b/0001-fix-CVE-2024-4418.patch new file mode 100644 index 0000000..bdd8509 --- /dev/null +++ b/0001-fix-CVE-2024-4418.patch @@ -0,0 +1,44 @@ +From 2983d845c83704f2b8bfab268db503ba93c54cc2 Mon Sep 17 00:00:00 2001 +From: Chunmei Xu +Date: Fri, 5 Jul 2024 10:09:21 +0800 +Subject: [PATCH 1/1] fix CVE-2024-4418 + +--- + src/rpc/virnetclient.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c +index 4ab8af6..15304cf 100644 +--- a/src/rpc/virnetclient.c ++++ b/src/rpc/virnetclient.c +@@ -1657,7 +1657,7 @@ static int virNetClientIOEventLoop(virNetClient *client, + #endif /* !WIN32 */ + int timeout = -1; + virNetMessage *msg = NULL; +- g_autoptr(GSource) G_GNUC_UNUSED source = NULL; ++ g_autoptr(GSource) source = NULL; + GIOCondition ev = 0; + struct virNetClientIOEventData data = { + .client = client, +@@ -1721,6 +1721,18 @@ static int virNetClientIOEventLoop(virNetClient *client, + + g_main_loop_run(client->eventLoop); + ++ /* ++ * If virNetClientIOEventFD ran, this GSource will already be ++ * destroyed due to G_SOURCE_REMOVE. It is harmless to re-destroy ++ * it, since we still own a reference. ++ * ++ * If virNetClientIOWakeup ran, it will have interrupted the ++ * g_main_loop_run call, before virNetClientIOEventFD could ++ * run, and thus the GSource is still registered, and we need ++ * to destroy it since it is referencing stack memory for 'data' ++ */ ++ g_source_destroy(source); ++ + #ifndef WIN32 + ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL)); + #endif /* !WIN32 */ +-- +2.41.0 + diff --git a/libvirt.spec b/libvirt.spec index 99a7079..d078efc 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -1,4 +1,4 @@ -%define anolis_release 4 +%define anolis_release 5 %define arches_qemu_kvm x86_64 aarch64 loongarch64 @@ -167,6 +167,8 @@ Patch0002: Implement-the-method-of-getting-host-info-for-loonga.patch Patch0003: Add-test-script-for-loongarch.patch Patch0004: conf-qemu-add-libvirt-support-reuse-id-for-hygon-CSV.patch Patch0005: cpu-Add-new-Dharma-CPU-model.patch + +Patch1000: 0001-fix-CVE-2024-4418.patch Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-daemon-config-network = %{version}-%{release} Requires: libvirt-daemon-config-nwfilter = %{version}-%{release} @@ -2145,6 +2147,9 @@ exit 0 %changelog +* Fri Jul 05 2024 mgb01105731 - 9.10.0-5 +- fix CVE-2024-4418 + * Tue May 14 2024 Yanjing Zhou - 9.10.0-4 - Add new Dharma CPU model -- Gitee