Skip to content

Commit 17452c2

Browse files
aninda-alaninda-al
authored
[MEDIUM] Patch libvirt for CVE-2024-1441 CVE-2024-2494 (#13886)
1 parent 085c675 commit 17452c2

3 files changed

Lines changed: 257 additions & 1 deletion

File tree

‎SPECS/libvirt/CVE-2024-1441.patch‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
From 2ebd1f031ecd93d74cb01051f23c8c4564998489 Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Thu, 22 May 2025 22:10:00 -0400
4+
Subject: [PATCH] Address CVE-2024-1441
5+
Upstream Patch Reference: https://github.com/libvirt/libvirt/commit/c664015fe3a7bf59db26686e9ed69af011c6ebb8.patch
6+
7+
---
8+
NEWS.rst | 16 ++++++++++++++++
9+
src/interface/interface_backend_udev.c | 2 +-
10+
2 files changed, 17 insertions(+), 1 deletion(-)
11+
12+
diff --git a/NEWS.rst b/NEWS.rst
13+
index d013fc7..97c3bc6 100644
14+
--- a/NEWS.rst
15+
+++ b/NEWS.rst
16+
@@ -10,6 +10,22 @@ For a more fine-grained view, use the `git log`_.
17+
18+
v10.0.0 (2024-01-15)
19+
====================
20+
+* **Security**
21+
+
22+
+ * ``CVE-2024-1441``: Fix off-by-one error leading to a crash
23+
+
24+
+ In **libvirt-1.0.0** there were couple of interface listing APIs
25+
+ introduced which had an off-by-one error. That error could lead to a
26+
+ very rare crash if an array was passed to those functions which did
27+
+ not fit all the interfaces.
28+
+
29+
+ In **libvirt-5.10** a check for non-NULL arrays has been adjusted to
30+
+ allow for NULL arrays with size 0 instead of rejecting all NULL
31+
+ arrays. However that made the above issue significantly worse since
32+
+ that off-by-one error now did not write beyond an array, but
33+
+ dereferenced said NULL pointer making the crash certain in a
34+
+ specific scenario in which a NULL array of size 0 was passed to the
35+
+ aforementioned functions.
36+
37+
* **New features**
38+
39+
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
40+
index fb6799e..4091483 100644
41+
--- a/src/interface/interface_backend_udev.c
42+
+++ b/src/interface/interface_backend_udev.c
43+
@@ -222,7 +222,7 @@ udevListInterfacesByStatus(virConnectPtr conn,
44+
g_autoptr(virInterfaceDef) def = NULL;
45+
46+
/* Ensure we won't exceed the size of our array */
47+
- if (count > names_len)
48+
+ if (count >= names_len)
49+
break;
50+
51+
path = udev_list_entry_get_name(dev_entry);
52+
--
53+
2.34.1
54+

‎SPECS/libvirt/CVE-2024-2494.patch‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
From f0fbb57dae0b9328f53c9d8ba9d672bfc9fd5cf3 Mon Sep 17 00:00:00 2001
2+
From: Aninda <v-anipradhan@microsoft.com>
3+
Date: Thu, 22 May 2025 22:27:55 -0400
4+
Subject: [PATCH] Address CVE-2024-2494
5+
Upstream Patch Reference: https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2.patch
6+
7+
---
8+
src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++
9+
src/rpc/gendispatch.pl | 5 +++
10+
2 files changed, 70 insertions(+)
11+
12+
diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
13+
index 7daf503..7542caa 100644
14+
--- a/src/remote/remote_daemon_dispatch.c
15+
+++ b/src/remote/remote_daemon_dispatch.c
16+
@@ -2291,6 +2291,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED,
17+
if (!conn)
18+
goto cleanup;
19+
20+
+ if (args->nparams < 0) {
21+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
22+
+ goto cleanup;
23+
+ }
24+
if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
25+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
26+
goto cleanup;
27+
@@ -2339,6 +2343,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS
28+
if (!conn)
29+
goto cleanup;
30+
31+
+ if (args->nparams < 0) {
32+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
33+
+ goto cleanup;
34+
+ }
35+
if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
36+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
37+
goto cleanup;
38+
@@ -2497,6 +2505,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED,
39+
goto cleanup;
40+
flags = args->flags;
41+
42+
+ if (args->nparams < 0) {
43+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
44+
+ goto cleanup;
45+
+ }
46+
if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
47+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
48+
goto cleanup;
49+
@@ -2717,6 +2729,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED,
50+
if (!(dom = get_nonnull_domain(conn, args->dom)))
51+
goto cleanup;
52+
53+
+ if (args->ncpumaps < 0) {
54+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
55+
+ goto cleanup;
56+
+ }
57+
+ if (args->maplen < 0) {
58+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
59+
+ goto cleanup;
60+
+ }
61+
if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
62+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
63+
goto cleanup;
64+
@@ -2811,6 +2831,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED,
65+
if (!(dom = get_nonnull_domain(conn, args->dom)))
66+
goto cleanup;
67+
68+
+ if (args->maplen < 0) {
69+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
70+
+ goto cleanup;
71+
+ }
72+
+
73+
/* Allocate buffers to take the results */
74+
if (args->maplen > 0)
75+
cpumaps = g_new0(unsigned char, args->maplen);
76+
@@ -2858,6 +2883,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED,
77+
if (!(dom = get_nonnull_domain(conn, args->dom)))
78+
goto cleanup;
79+
80+
+ if (args->maxinfo < 0) {
81+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
82+
+ goto cleanup;
83+
+ }
84+
+ if (args->maplen < 0) {
85+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
86+
+ goto cleanup;
87+
+ }
88+
if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
89+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
90+
goto cleanup;
91+
@@ -3096,6 +3129,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
92+
93+
flags = args->flags;
94+
95+
+ if (args->nparams < 0) {
96+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
97+
+ goto cleanup;
98+
+ }
99+
if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
100+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
101+
goto cleanup;
102+
@@ -3156,6 +3193,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED,
103+
104+
flags = args->flags;
105+
106+
+ if (args->nparams < 0) {
107+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
108+
+ goto cleanup;
109+
+ }
110+
if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
111+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
112+
goto cleanup;
113+
@@ -3216,6 +3257,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED,
114+
115+
flags = args->flags;
116+
117+
+ if (args->nparams < 0) {
118+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
119+
+ goto cleanup;
120+
+ }
121+
if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
122+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
123+
goto cleanup;
124+
@@ -3277,6 +3322,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED,
125+
126+
flags = args->flags;
127+
128+
+ if (args->nparams < 0) {
129+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
130+
+ goto cleanup;
131+
+ }
132+
if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
133+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
134+
goto cleanup;
135+
@@ -3339,6 +3388,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED,
136+
137+
flags = args->flags;
138+
139+
+ if (args->nparams < 0) {
140+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
141+
+ goto cleanup;
142+
+ }
143+
if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
144+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
145+
goto cleanup;
146+
@@ -3514,6 +3567,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED,
147+
if (!conn)
148+
goto cleanup;
149+
150+
+ if (args->nparams < 0) {
151+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
152+
+ goto cleanup;
153+
+ }
154+
if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
155+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
156+
goto cleanup;
157+
@@ -5079,6 +5136,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED,
158+
159+
flags = args->flags;
160+
161+
+ if (args->nparams < 0) {
162+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
163+
+ goto cleanup;
164+
+ }
165+
if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
166+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
167+
goto cleanup;
168+
@@ -5299,6 +5360,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
169+
170+
flags = args->flags;
171+
172+
+ if (args->nparams < 0) {
173+
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
174+
+ goto cleanup;
175+
+ }
176+
if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
177+
virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
178+
goto cleanup;
179+
diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
180+
index 5ce988c..c5842dc 100755
181+
--- a/src/rpc/gendispatch.pl
182+
+++ b/src/rpc/gendispatch.pl
183+
@@ -1070,6 +1070,11 @@ elsif ($mode eq "server") {
184+
print "\n";
185+
186+
if ($single_ret_as_list) {
187+
+ print " if (args->$single_ret_list_max_var < 0) {\n";
188+
+ print " virReportError(VIR_ERR_RPC,\n";
189+
+ print " \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
190+
+ print " goto cleanup;\n";
191+
+ print " }\n";
192+
print " if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
193+
print " virReportError(VIR_ERR_RPC,\n";
194+
print " \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
195+
--
196+
2.34.1
197+

‎SPECS/libvirt/libvirt.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@
185185
Summary: Library providing a simple virtualization API
186186
Name: libvirt
187187
Version: 10.0.0
188-
Release: 3%{?dist}
188+
Release: 4%{?dist}
189189
License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
190190
Vendor: Microsoft Corporation
191191
Distribution: Azure Linux
@@ -196,6 +196,8 @@ URL: https://libvirt.org/
196196
%endif
197197
Source: https://download.libvirt.org/%{?mainturl}libvirt-%{version}.tar.xz
198198
Patch0: libvirt-conf.patch
199+
Patch1: CVE-2024-1441.patch
200+
Patch2: CVE-2024-2494.patch
199201

200202
Requires: libvirt-daemon = %{version}-%{release}
201203
Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -2186,6 +2188,9 @@ exit 0
21862188
%endif
21872189

21882190
%changelog
2191+
* Fri May 23 2025 Aninda Pradhan <v-anipradhan@microsoft.com> - 10.0.0-4
2192+
- Fix for CVE-2024-1441 and CVE-2024-2494
2193+
21892194
* Thu May 30 2024 Sharath Srikanth Chellappa <sharathsr@microsoft.com> - 10.0.0-3
21902195
- Add patch to libvirt.conf to work with kubevirt.
21912196

0 commit comments

Comments
 (0)