File fbf31e1a-CVE-2018-1064-qemu-ga.patch of Package libvirt.10484

Overview Repositories Revisions Requests Users Attributes Meta

File fbf31e1a-CVE-2018-1064-qemu-ga.patch of Package libvirt.10484 (Revision 18dfa78b5e94dabb268aa28fb155d3e8)

Currently displaying revision 18dfa78b5e94dabb268aa28fb155d3e8 , Show latest

>From aab109702b958834c9d97bb82f950ee1d11d0889 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 1 Mar 2018 14:55:26 +0000
Subject: [PATCH] qemu: avoid denial of service reading from QEMU guest agent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We read from the agent until seeing a \r\n pair to indicate a completed
reply or event. To avoid memory denial-of-service though, we must have a
size limit on amount of data we buffer. 10 MB is large enough that it
ought to cope with normal agent replies, and small enough that we're not
consuming unreasonable mem.

This is identical to the flaw we had reading from the QEMU monitor
as CVE-2018-5748, so rather embarrassing that we forgot to fix
the agent code at the same time.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 src/qemu/qemu_agent.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

Index: libvirt-1.2.18.4/src/qemu/qemu_agent.c
===================================================================
--- libvirt-1.2.18.4.orig/src/qemu/qemu_agent.c
+++ libvirt-1.2.18.4/src/qemu/qemu_agent.c
@@ -53,6 +53,15 @@ VIR_LOG_INIT("qemu.qemu_agent");
 #define DEBUG_IO 0
 #define DEBUG_RAW_IO 0
 
+/* We read from QEMU until seeing a \r\n pair to indicate a
+ * completed reply or event. To avoid memory denial-of-service
+ * though, we must have a size limit on amount of data we
+ * buffer. 10 MB is large enough that it ought to cope with
+ * normal QEMU replies, and small enough that we're not
+ * consuming unreasonable mem.
+ */
+#define QEMU_AGENT_MAX_RESPONSE (10 * 1024 * 1024)
+
 /* When you are the first to uncomment this,
  * don't forget to uncomment the corresponding
  * part in qemuAgentIOProcessEvent as well.
@@ -518,6 +527,12 @@ qemuAgentIORead(qemuAgentPtr mon)
     int ret = 0;
 
     if (avail < 1024) {
+        if (mon->bufferLength >= QEMU_AGENT_MAX_RESPONSE) {
+            virReportSystemError(ERANGE,
+                                 _("No complete agent response found in %d bytes"),
+                                 QEMU_AGENT_MAX_RESPONSE);
+            return -1;
+        }
         if (VIR_REALLOC_N(mon->buffer,
                           mon->bufferLength + 1024) < 0)
             return -1;

Places

File fbf31e1a-CVE-2018-1064-qemu-ga.patch of Package libvirt.10484 (Revision 18dfa78b5e94dabb268aa28fb155d3e8)

Places