File bb848fee-CVE-2016-5008.patch of Package libvirt.11411

Overview Repositories Revisions Requests Users Attributes Meta

File bb848fee-CVE-2016-5008.patch of Package libvirt.11411

commit f39de9abfd4b8b19a012169355a0e73dae427bd0
Author: Jiri Denemark <jdenemar@redhat.com>
Date:   Tue Jun 28 14:39:58 2016 +0200

qemu: Let empty default VNC password work as documented
    
    CVE-2016-5008
    
    Setting an empty graphics password is documented as a way to disable
    VNC/SPICE access, but QEMU does not always behaves like that. VNC would
    happily accept the empty password. Let's enforce the behavior by setting
    password expiration to "now".
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1180092
    
    Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
    (cherry picked from commit bb848feec0f3f10e92dd8e5231ae7aa89b5598f3)
    (cherry picked from commit d933f68ee660566b52cd90330aee0d5f414636a4)

Index: libvirt-1.2.5/src/qemu/qemu_hotplug.c
===================================================================
--- libvirt-1.2.5.orig/src/qemu/qemu_hotplug.c
+++ libvirt-1.2.5/src/qemu/qemu_hotplug.c
@@ -3463,6 +3463,7 @@ qemuDomainChangeGraphicsPasswords(virQEM
     time_t now = time(NULL);
     char expire_time [64];
     const char *connected = NULL;
+    const char *password;
     int ret = -1;
     virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
 
@@ -3470,15 +3471,13 @@ qemuDomainChangeGraphicsPasswords(virQEM
         ret = 0;
         goto cleanup;
     }
+    password = auth->passwd ? auth->passwd : defaultPasswd;
 
     if (auth->connected)
         connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected);
 
     qemuDomainObjEnterMonitor(driver, vm);
-    ret = qemuMonitorSetPassword(priv->mon,
-                                 type,
-                                 auth->passwd ? auth->passwd : defaultPasswd,
-                                 connected);
+    ret = qemuMonitorSetPassword(priv->mon, type, password, connected);
 
     if (ret == -2) {
         if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) {
@@ -3486,14 +3485,15 @@ qemuDomainChangeGraphicsPasswords(virQEM
                            _("Graphics password only supported for VNC"));
             ret = -1;
         } else {
-            ret = qemuMonitorSetVNCPassword(priv->mon,
-                                            auth->passwd ? auth->passwd : defaultPasswd);
+            ret = qemuMonitorSetVNCPassword(priv->mon, password);
         }
     }
     if (ret != 0)
         goto end_job;
 
-    if (auth->expires) {
+    if (password[0] == '\0') {
+        snprintf(expire_time, sizeof(expire_time), "now");
+    } else if (auth->expires) {
         time_t lifetime = auth->validTo - now;
         if (lifetime <= 0)
             snprintf(expire_time, sizeof(expire_time), "now");

Places

File bb848fee-CVE-2016-5008.patch of Package libvirt.11411

Places