summaryrefslogtreecommitdiffstats
path: root/recipes-extended/libvirt/libvirt/CVE-2023-3750.patch
blob: 13ead87b88baa0df42d6e5b3f590a144d27d2496 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
From 3fe8b15323a4666564c519f32fd4ab072c472051 Mon Sep 17 00:00:00 2001
From: Peter Krempa <pkrempa@redhat.com>
Date: Thu, 13 Jul 2023 16:16:37 +0200
Subject: [PATCH] storage: Fix returning of locked objects from
 'virStoragePoolObjListSearch'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CVE-2023-3750

'virStoragePoolObjListSearch' explicitly documents that it's returning
a pointer to a locked and ref'd pool that maches the lookup function.

This was not the case as in commit 0c4b391e2a9 (released in
libvirt-8.3.0) the code was accidentally converted to use 'VIR_LOCK_GUARD'
which auto-unlocked it when leaving the scope, even when the code was
originally "leaking" the lock.

Revert the corresponding conversion and add a comment that this function
is intentionally leaking a locked object.

Fixes: 0c4b391e2a9
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2221851
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>

CVE: CVE-2023-3750
Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/9a47442366fcf8a7b6d7422016d7bbb6764a1098]
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 src/conf/virstorageobj.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c
index 7010e97..59fa5da 100644
--- a/src/conf/virstorageobj.c
+++ b/src/conf/virstorageobj.c
@@ -454,11 +454,16 @@ virStoragePoolObjListSearchCb(const void *payload,
     virStoragePoolObj *obj = (virStoragePoolObj *) payload;
     struct _virStoragePoolObjListSearchData *data =
         (struct _virStoragePoolObjListSearchData *)opaque;
-    VIR_LOCK_GUARD lock = virObjectLockGuard(obj);
 
+    virObjectLock(obj);
+
+    /* If we find the matching pool object we must return while the object is
+     * locked as the caller wants to return a locked object. */
     if (data->searcher(obj, data->opaque))
         return 1;
 
+    virObjectUnlock(obj);
+
     return 0;
 }
 
-- 
2.25.1