Bugzilla – Bug 827801
VUL-1: libvirt: CVE-2013-2230: incorrect return value in qemuConnectDomainEventRegisterAny()
Last modified: 2014-07-07 10:04:26 UTC
EMBARGOED via libvirt-security list: (sorry the patch was inline) ----------------------8<--------------- Don't overwrite the callback ID returned by virDomainEventStateRegisterID in ret by 0. Introduced by abf75aea. https://bugzilla.redhat.com/show_bug.cgi?id=980428 --- Reported by zhenfeng wang Only affects 1.1.0. The bug was filed as public, does that mean I can send the patch to the public list right away? src/qemu/qemu_driver.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6a83fda..1355d90 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9914,9 +9914,7 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn, driver->domainEventState, dom, eventID, callback, opaque, freecb, &ret) < 0) - goto cleanup; - - ret = 0; + ret = -1; cleanup: return ret;
bugbot adjusting priority
From: Petr Matousek <pmatouse@redhat.com> Subject: [Libvirt-Security] [NOT A CVE REQUEST] CVE-2013-2230 -- libvirt: multiple registered events crash flaw was found in the way multiple events registration were handled in libvirt qemu driver. A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd. Upstream fix: http://libvirt.org/git/?p=libvirt.git;a=commit;h=f38c8185f97720ecae7ef2291fbaa5d6b0209e17 References: https://bugzilla.redhat.com/show_bug.cgi?id=981476 Thanks, -- Petr Matousek / Red Hat Security Response Team
This is an autogenerated message for OBS integration: This bug (827801) was mentioned in https://build.opensuse.org/request/show/182939 Factory / libvirt
libvirt 1.1.0 + commit f6e543ba has been submitted to Factory - SR#182939. IMO, this bug can now be closed.
ok