From 9f8f14e5ee63d35b3d1d067009d50e63c7307dea Mon Sep 17 00:00:00 2001 From: yezengruan Date: Mon, 20 Jun 2022 09:24:26 +0800 Subject: [PATCH] fix CVE-2022-0897 (openeuler !66) nwfilter: fix crash when counting number of network filters (CVE-2022-0897) Signed-off-by: yezengruan (cherry picked from commit abc01259ad25cf3e2647f6aae6e4e8979a4aa9f8) --- libvirt.spec | 6 ++- ...sh-when-counting-number-of-network-f.patch | 54 +++++++++++++++++++ 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 nwfilter-fix-crash-when-counting-number-of-network-f.patch diff --git a/libvirt.spec b/libvirt.spec index f4666f4..65f3309 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -101,7 +101,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 6.2.0 -Release: 39 +Release: 40 License: LGPLv2+ URL: https://libvirt.org/ @@ -249,6 +249,7 @@ Patch0136: apparmor-Permit-new-capabilities-required-by-libvirt.patch Patch0137: virsh-Display-vhostuser-socket-path-in-domblklist.patch Patch0138: sw_64-Add-sw64-architecture-support.patch Patch0139: src-workaround-warning-triggered-in-glib-2.69.patch +Patch0140: nwfilter-fix-crash-when-counting-number-of-network-f.patch Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-daemon-config-network = %{version}-%{release} @@ -1983,6 +1984,9 @@ exit 0 %changelog +* Mon Jun 20 2022 yezengruan - 6.2.0-40 +- nwfilter: fix crash when counting number of network filters (CVE-2022-0897) + * Mon Jun 13 2022 yezengruan - 6.2.0-39 - sw_64: Add sw64 architecture support - src: workaround warning triggered in glib 2.69 diff --git a/nwfilter-fix-crash-when-counting-number-of-network-f.patch b/nwfilter-fix-crash-when-counting-number-of-network-f.patch new file mode 100644 index 0000000..ddb5caf --- /dev/null +++ b/nwfilter-fix-crash-when-counting-number-of-network-f.patch @@ -0,0 +1,54 @@ +From b67c839e409b4e49b69ffdab947af91791820411 Mon Sep 17 00:00:00 2001 +From: AlexChen +Date: Tue, 8 Mar 2022 17:28:38 +0000 +Subject: [PATCH] nwfilter: fix crash when counting number of network filters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The virNWFilterObjListNumOfNWFilters method iterates over the +driver->nwfilters, accessing virNWFilterObj instances. As such +it needs to be protected against concurrent modification of +the driver->nwfilters object. + +This API allows unprivileged users to connect, so users with +read-only access to libvirt can cause a denial of service +crash if they are able to race with a call of virNWFilterUndefine. +Since network filters are usually statically defined, this is +considered a low severity problem. + +This is assigned CVE-2022-0897. + +Reviewed-by: Eric Blake +Signed-off-by: Daniel P. Berrangé +cherry-picked from a4947e8f63c3e6 +Signed-off-by: AlexChen +--- + src/nwfilter/nwfilter_driver.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c +index 1c407727db..27500d192a 100644 +--- a/src/nwfilter/nwfilter_driver.c ++++ b/src/nwfilter/nwfilter_driver.c +@@ -514,11 +514,15 @@ nwfilterLookupByName(virConnectPtr conn, + static int + nwfilterConnectNumOfNWFilters(virConnectPtr conn) + { ++ int ret; + if (virConnectNumOfNWFiltersEnsureACL(conn) < 0) + return -1; + +- return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn, +- virConnectNumOfNWFiltersCheckACL); ++ nwfilterDriverLock(); ++ ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn, ++ virConnectNumOfNWFiltersCheckACL); ++ nwfilterDriverUnlock(); ++ return ret; + } + + +-- +2.27.0 + -- Gitee