Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP5:Update
xen.481
xsa119.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xsa119.patch of Package xen.481
References: bsc#919663 CVE-2015-2152 XSA-119 From: Ian Campbell <ian.campbell@citrix.com> Date: Fri, 20 Feb 2015 14:41:09 +0000 Subject: tools: libxl: Explicitly disable graphics backends on qemu cmdline By default qemu will try to create some sort of backend for the emulated VGA device, either SDL or VNC. However when the user specifies sdl=0 and vnc=0 in their configuration libxl was not explicitly disabling either backend, which could lead to one unexpectedly running. If either sdl=1 or vnc=1 is configured then both before and after this change only the backends which are explicitly enabled are configured, i.e. this issue only occurs when all backends are supposed to have been disabled. This affects qemu-xen and qemu-xen-traditionally differently. If qemu-xen was compiled with SDL support then this would result in an SDL window being opened if $DISPLAY is valid, or a failure to start the guest if not. Passing "-display none" to qemu before any further -sdl options disables this default behaviour and ensures that SDL is only started if the libxl configuration demands it. If qemu-xen was compiled without SDL support then qemu would instead start a VNC server listening on ::1 (IPv6 localhost) or 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. Explicitly pass "-vnc none" when vnc is not enabled in the libxl configuration to remove this possibility. qemu-xen-traditional would never start a vnc backend unless asked. However by default it will start an SDL backend, the way to disable this is to pass a -vnc option. In other words passing "-vnc none" will disable both vnc and sdl by default. sdl can then be reenabled if configured by subsequent use of the -sdl option. Tested with both qemu-xen and qemu-xen-traditional built with SDL support and: xl cr # defaults xl cr sdl=0 vnc=0 xl cr sdl=1 vnc=0 xl cr sdl=0 vnc=1 xl cr sdl=0 vnc=0 vga=\"none\" xl cr sdl=0 vnc=0 nographic=1 with both valid and invalid $DISPLAY. This is CVE-2015-2152 / XSA-119. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> --- a/tools/libxl/libxl_dm.c +++ b/tools/libxl/libxl_dm.c @@ -179,7 +179,14 @@ static char ** libxl__build_device_model if (libxl_defbool_val(vnc->findunused)) { flexarray_append(dm_args, "-vncunused"); } - } + } else + /* + * VNC is not enabled by default by qemu-xen-traditional, + * however passing -vnc none causes SDL to not be + * (unexpectedly) enabled by default. This is overridden by + * explicitly passing -sdl below as required. + */ + flexarray_append_pair(dm_args, "-vnc", "none"); if (sdl) { flexarray_append(dm_args, "-sdl"); @@ -469,7 +476,17 @@ static char ** libxl__build_device_model } flexarray_append(dm_args, vncarg); - } + } else + /* + * Ensure that by default no vnc server is created. + */ + flexarray_append_pair(dm_args, "-vnc", "none"); + + /* + * Ensure that by default no display backend is created. Further + * options given below might then enable more. + */ + flexarray_append_pair(dm_args, "-display", "none"); if (sdl) { flexarray_append(dm_args, "-sdl");
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor