From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>

Date: Fri, 14 Jun 2019 09:14:53 +0200

Subject: [PATCH] api: disallow virDomainManagedSaveDefineXML on read-only

 connections

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

The virDomainManagedSaveDefineXML can be used to alter the domain's

config used for managedsave or even execute arbitrary emulator binaries.

Forbid it on read-only connections.

Fixes: CVE-2019-10166

Reported-by: Matthias Gerstner <mgerstner@suse.de>

Signed-off-by: Ján Tomko <jtomko@redhat.com>

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

(cherry picked from commit db0b78457f183e4c7ac45bc94de86044a1e2056a)

---

 src/libvirt-domain.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c

index 1cc8537c04..f77fc23a3f 100644

--- a/src/libvirt-domain.c

+++ b/src/libvirt-domain.c

@@ -9563,6 +9563,7 @@ virDomainManagedSaveDefineXML(virDomainPtr domain, const char *dxml,

     virCheckDomainReturn(domain, -1);

     conn = domain->conn;

+    virCheckReadOnlyGoto(conn->flags, error);

     if (conn->driver->domainManagedSaveDefineXML) {

         int ret;