|
 |
43fe83 |
From 7f49eef97945667494ba0a8127ee2290ceb7fdb8 Mon Sep 17 00:00:00 2001
|
|
|
43fe83 |
Message-Id: <7f49eef97945667494ba0a8127ee2290ceb7fdb8.1381871411.git.jdenemar@redhat.com>
|
|
|
43fe83 |
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
|
43fe83 |
Date: Mon, 7 Oct 2013 16:40:51 +0100
|
|
|
43fe83 |
Subject: [PATCH] Fix crash in libvirtd when events are registered & ACLs
|
|
|
43fe83 |
active (CVE-2013-4399)
|
|
|
43fe83 |
|
|
|
43fe83 |
For
|
|
|
43fe83 |
|
|
|
43fe83 |
https://bugzilla.redhat.com/show_bug.cgi?id=1011429
|
|
|
43fe83 |
|
|
|
43fe83 |
When a client disconnects from libvirtd, all event callbacks
|
|
|
43fe83 |
must be removed. This involves running the public API
|
|
|
43fe83 |
|
|
|
43fe83 |
virConnectDomainEventDeregisterAny
|
|
|
43fe83 |
|
|
|
43fe83 |
This code does not run in normal API dispatch context, so no
|
|
|
43fe83 |
identity was set. The result was that the access control drivers
|
|
|
43fe83 |
denied the attempt to deregister callbacks. The callbacks thus
|
|
|
43fe83 |
continued to trigger after the client was free'd causing fairly
|
|
|
43fe83 |
predictable use of free memory & a crash.
|
|
|
43fe83 |
|
|
|
43fe83 |
This can be triggered by any client with readonly access when
|
|
|
43fe83 |
the ACL drivers are active.
|
|
|
43fe83 |
|
|
|
43fe83 |
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
43fe83 |
(cherry picked from commit 8294aa0c1750dcb49d6345cd9bd97bf421580d8b)
|
|
|
43fe83 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
43fe83 |
---
|
|
|
43fe83 |
daemon/remote.c | 6 ++++++
|
|
|
43fe83 |
1 file changed, 6 insertions(+)
|
|
|
43fe83 |
|
|
|
43fe83 |
diff --git a/daemon/remote.c b/daemon/remote.c
|
|
|
43fe83 |
index afd9fb5..1ba8ac2 100644
|
|
|
43fe83 |
--- a/daemon/remote.c
|
|
|
43fe83 |
+++ b/daemon/remote.c
|
|
|
43fe83 |
@@ -666,8 +666,11 @@ void remoteClientFreeFunc(void *data)
|
|
|
43fe83 |
|
|
|
43fe83 |
/* Deregister event delivery callback */
|
|
|
43fe83 |
if (priv->conn) {
|
|
|
43fe83 |
+ virIdentityPtr sysident = virIdentityGetSystem();
|
|
|
43fe83 |
size_t i;
|
|
|
43fe83 |
|
|
|
43fe83 |
+ virIdentitySetCurrent(sysident);
|
|
|
43fe83 |
+
|
|
|
43fe83 |
for (i = 0; i < VIR_DOMAIN_EVENT_ID_LAST; i++) {
|
|
|
43fe83 |
if (priv->domainEventCallbackID[i] != -1) {
|
|
|
43fe83 |
VIR_DEBUG("Deregistering to relay remote events %zu", i);
|
|
|
43fe83 |
@@ -678,6 +681,9 @@ void remoteClientFreeFunc(void *data)
|
|
|
43fe83 |
}
|
|
|
43fe83 |
|
|
|
43fe83 |
virConnectClose(priv->conn);
|
|
|
43fe83 |
+
|
|
|
43fe83 |
+ virIdentitySetCurrent(NULL);
|
|
|
43fe83 |
+ virObjectUnref(sysident);
|
|
|
43fe83 |
}
|
|
|
43fe83 |
|
|
|
43fe83 |
VIR_FREE(priv);
|
|
|
43fe83 |
--
|
|
|
43fe83 |
1.8.3.2
|
|
|
43fe83 |
|