File 8a3f8d95-CVE-2024-2494.patch of Package libvirt

Overview Repositories Revisions Requests Users Attributes Meta

File 8a3f8d95-CVE-2024-2494.patch of Package libvirt

commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Fri Mar 15 10:47:50 2024 +0000

remote: check for negative array lengths before allocation
    
    While the C API entry points will validate non-negative lengths
    for various parameters, the RPC server de-serialization code
    will need to allocate memory for arrays before entering the C
    API. These allocations will thus happen before the non-negative
    length check is performed.
    
    Passing a negative length to the g_new0 function will usually
    result in a crash due to the negative length being treated as
    a huge positive number.
    
    This was found and diagnosed by ALT Linux Team with AFLplusplus.
    
    CVE-2024-2494
    Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
    Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
    Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Index: libvirt-7.1.0/src/remote/remote_daemon_dispatch.c
===================================================================
--- libvirt-7.1.0.orig/src/remote/remote_daemon_dispatch.c
+++ libvirt-7.1.0/src/remote/remote_daemon_dispatch.c
@@ -2330,6 +2330,10 @@ remoteDispatchDomainGetSchedulerParamete
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2378,6 +2382,10 @@ remoteDispatchDomainGetSchedulerParamete
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2536,6 +2544,10 @@ remoteDispatchDomainBlockStatsFlags(virN
         goto cleanup;
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2764,6 +2776,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNe
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->ncpumaps < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
+        goto cleanup;
+    }
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
+        goto cleanup;
+    }
     if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -2858,6 +2878,11 @@ remoteDispatchDomainGetEmulatorPinInfo(v
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
+        goto cleanup;
+    }
+
     /* Allocate buffers to take the results */
     if (args->maplen > 0)
         cpumaps = g_new0(unsigned char, args->maplen);
@@ -2905,6 +2930,14 @@ remoteDispatchDomainGetVcpus(virNetServe
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->maxinfo < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
+        goto cleanup;
+    }
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
+        goto cleanup;
+    }
     if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -3145,6 +3178,10 @@ remoteDispatchDomainGetMemoryParameters(
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3205,6 +3242,10 @@ remoteDispatchDomainGetNumaParameters(vi
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3265,6 +3306,10 @@ remoteDispatchDomainGetBlkioParameters(v
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3326,6 +3371,10 @@ remoteDispatchNodeGetCPUStats(virNetServ
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3393,6 +3442,10 @@ remoteDispatchNodeGetMemoryStats(virNetS
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3573,6 +3626,10 @@ remoteDispatchDomainGetBlockIoTune(virNe
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5117,6 +5174,10 @@ remoteDispatchDomainGetInterfaceParamete
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5337,6 +5398,10 @@ remoteDispatchNodeGetMemoryParameters(vi
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
Index: libvirt-7.1.0/src/rpc/gendispatch.pl
===================================================================
--- libvirt-7.1.0.orig/src/rpc/gendispatch.pl
+++ libvirt-7.1.0/src/rpc/gendispatch.pl
@@ -1073,6 +1073,11 @@ elsif ($mode eq "server") {
         print "\n";
 
         if ($single_ret_as_list) {
+            print "    if (args->$single_ret_list_max_var < 0) {\n";
+            print "        virReportError(VIR_ERR_RPC,\n";
+            print "                       \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
+            print "        goto cleanup;\n";
+            print "    }\n";
             print "    if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
             print "        virReportError(VIR_ERR_RPC,\n";
             print "                       \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";

xxxxxxxxxx
 
commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Fri Mar 15 10:47:50 2024 +0000
​
    remote: check for negative array lengths before allocation
    
    While the C API entry points will validate non-negative lengths
    for various parameters, the RPC server de-serialization code
    will need to allocate memory for arrays before entering the C
    API. These allocations will thus happen before the non-negative
    length check is performed.
    
    Passing a negative length to the g_new0 function will usually
    result in a crash due to the negative length being treated as
    a huge positive number.
    
    This was found and diagnosed by ALT Linux Team with AFLplusplus.
    
    CVE-2024-2494
    Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
    Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
    Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
​
Index: libvirt-7.1.0/src/remote/remote_daemon_dispatch.c
===================================================================
--- libvirt-7.1.0.orig/src/remote/remote_daemon_dispatch.c
+++ libvirt-7.1.0/src/remote/remote_daemon_dispatch.c
@@ -2330,6 +2330,10 @@ remoteDispatchDomainGetSchedulerParamete
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2378,6 +2382,10 @@ remoteDispatchDomainGetSchedulerParamete
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2536,6 +2544,10 @@ remoteDispatchDomainBlockStatsFlags(virN
         goto cleanup;
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2764,6 +2776,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNe
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->ncpumaps < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
+        goto cleanup;
+    }
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
+        goto cleanup;
+    }
     if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -2858,6 +2878,11 @@ remoteDispatchDomainGetEmulatorPinInfo(v
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
+        goto cleanup;
+    }
+
     /* Allocate buffers to take the results */
     if (args->maplen > 0)
         cpumaps = g_new0(unsigned char, args->maplen);
@@ -2905,6 +2930,14 @@ remoteDispatchDomainGetVcpus(virNetServe
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 
+    if (args->maxinfo < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
+        goto cleanup;
+    }
+    if (args->maplen < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
+        goto cleanup;
+    }
     if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -3145,6 +3178,10 @@ remoteDispatchDomainGetMemoryParameters(
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3205,6 +3242,10 @@ remoteDispatchDomainGetNumaParameters(vi
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3265,6 +3306,10 @@ remoteDispatchDomainGetBlkioParameters(v
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3326,6 +3371,10 @@ remoteDispatchNodeGetCPUStats(virNetServ
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3393,6 +3442,10 @@ remoteDispatchNodeGetMemoryStats(virNetS
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3573,6 +3626,10 @@ remoteDispatchDomainGetBlockIoTune(virNe
     if (!conn)
         goto cleanup;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5117,6 +5174,10 @@ remoteDispatchDomainGetInterfaceParamete
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5337,6 +5398,10 @@ remoteDispatchNodeGetMemoryParameters(vi
 
     flags = args->flags;
 
+    if (args->nparams < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
+        goto cleanup;
+    }
     if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
Index: libvirt-7.1.0/src/rpc/gendispatch.pl
===================================================================
--- libvirt-7.1.0.orig/src/rpc/gendispatch.pl
+++ libvirt-7.1.0/src/rpc/gendispatch.pl
@@ -1073,6 +1073,11 @@ elsif ($mode eq "server") {
         print "\n";
 
         if ($single_ret_as_list) {
+            print "    if (args->$single_ret_list_max_var < 0) {\n";
+            print "        virReportError(VIR_ERR_RPC,\n";
+            print "                       \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
+            print "        goto cleanup;\n";
+            print "    }\n";
             print "    if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
             print "        virReportError(VIR_ERR_RPC,\n";
             print "                       \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
​

Places

File 8a3f8d95-CVE-2024-2494.patch of Package libvirt

Places