|
 |
c401cc |
From f97340639134f6fbafb00f87898b4abddf9b4d4d Mon Sep 17 00:00:00 2001
|
|
|
c401cc |
Message-Id: <f97340639134f6fbafb00f87898b4abddf9b4d4d@dist-git>
|
|
|
c401cc |
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
|
c401cc |
Date: Tue, 18 Feb 2014 15:45:32 -0700
|
|
|
c401cc |
Subject: [PATCH] Fix path used for USB device attach with LXC
|
|
|
c401cc |
|
|
|
c401cc |
https://bugzilla.redhat.com/show_bug.cgi?id=1045643
|
|
|
c401cc |
prereq of CVE-2013-6456
|
|
|
c401cc |
|
|
|
c401cc |
The LXC code missed the 'usb' component out of the path
|
|
|
c401cc |
/dev/bus/usb/$BUSNUM/$DEVNUM, so it failed to actually
|
|
|
c401cc |
setup cgroups for the device. This was in fact lucky
|
|
|
c401cc |
because the call to virLXCSetupHostUsbDeviceCgroup
|
|
|
c401cc |
was also mistakenly passing '&priv->cgroup' instead of
|
|
|
c401cc |
just 'priv->cgroup'. So once the path is fixed, libvirtd
|
|
|
c401cc |
would then crash trying to access the bogus virCgroupPtr
|
|
|
c401cc |
pointer. This would have been a security issue, were it
|
|
|
c401cc |
not for the bogus path preventing the pointer reference
|
|
|
c401cc |
being reached.
|
|
|
c401cc |
|
|
|
c401cc |
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
c401cc |
(cherry picked from commit c3648972222d4eb056e6e667c193ba56a7aa3557)
|
|
|
c401cc |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
---
|
|
|
c401cc |
src/lxc/lxc_driver.c | 4 ++--
|
|
|
c401cc |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
c401cc |
|
|
|
c401cc |
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
|
|
|
c401cc |
index 48456ad..63c545c 100644
|
|
|
c401cc |
--- a/src/lxc/lxc_driver.c
|
|
|
c401cc |
+++ b/src/lxc/lxc_driver.c
|
|
|
c401cc |
@@ -3338,7 +3338,7 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
|
|
|
c401cc |
(unsigned long long)priv->initpid) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (virAsprintf(&dstdir, "%s/dev/bus/%03d",
|
|
|
c401cc |
+ if (virAsprintf(&dstdir, "%s/dev/bus/usb/%03d",
|
|
|
c401cc |
vroot,
|
|
|
c401cc |
def->source.subsys.u.usb.bus) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
@@ -3403,7 +3403,7 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
|
|
|
c401cc |
|
|
|
c401cc |
if (virUSBDeviceFileIterate(usb,
|
|
|
c401cc |
virLXCSetupHostUsbDeviceCgroup,
|
|
|
c401cc |
- &priv->cgroup) < 0)
|
|
|
c401cc |
+ priv->cgroup) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
ret = 0;
|
|
|
c401cc |
--
|
|
|
c401cc |
1.9.0
|
|
|
c401cc |
|