Bugzilla – Bug 838642
VUL-1: CVE-2013-4297: libvirt: Fix crash in virFileNBDDeviceAssociate
Last modified: 2021-08-11 09:38:12 UTC
semi embargoed via libvirt security list, 2 week embargo starting Sep 3, but no specific date set yet so perhaps CRD 2013-09-17 CVE-2013-4297 https://www.redhat.com/archives/libvir-list/2013-September/msg00205.html From: "Daniel P. Berrange" <berrange@redhat.com> If there were no free NBD devices found, then it was possible to jump to a cleanup block which calls VIR_FREE on an uninitialized string pointer. This would cause the libvirt_lxc process to crash when starting an LXC guest if NBD devices were exhausted. If fine grained ACLs are active and the user is only given permission to start/stop guests, then this flaw can be classed as a security issue since the libvirt_lxc process will not have finished setting up the container security confinement at this point and the user triggering it is less privileged than root. This was introduced in release v1.0.6 onwards by commit 8aabd597b379db5ae1655e36dff4f10d5622830a Author: Daniel P. Berrange <berrange@redhat.com> Date: Mon Apr 22 15:06:16 2013 +0100 Add a helper API for setting up a NBD device with qemu-nbd Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
SLE-10-SP4 Not affected 0.3.3 SLE-11-SP2 Not affected 0.9.6 SLE-11-SP3 Not affected 1.0.5.4
openSUSE:12.2 Not affected 0.9.11.9 openSUSE:12.3 Not affected 1.0.2
This only affects Factory, but I suppose I can't really submit it there due to the "semi-embargo". The fix is already in libvirt.git http://libvirt.org/git/?p=libvirt.git;a=commit;h=2dba0323ff0cec31bdcea9dd3b2428af297401f2 but as noted on the libvirt-security list the commit message doesn't mention any vulnerability, so still embargoed :-/. Should the bug remain open until Factory/13.1 is fixed?
Created attachment 556046 [details] Backport of upstream commit 2dba0323 for libvirt 1.1.2 This is a backport of the commit for libvirt 1.1.2, which I'm hoping will be accepted to Factory for 13.1 beta1 - see SR#197361.
This is an autogenerated message for OBS integration: This bug (838642) was mentioned in https://build.opensuse.org/request/show/201962 Factory / libvirt