External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 06:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk

Browse Source 
Live definition was used to look up the disk index while persistent one
was indexed leading to a crash in qemuDomainGetBlockIoTune. Use the
correct def and report a nice error.

Unfortunately it's accessible via read-only connection, though it can
only crash libvirtd in the cases where the guest is hot-plugging disks
without reflecting those changes to the persistent definition.  So
avoiding hotplug, or doing hotplug where persistent is always modified
alongside live definition, will avoid the out-of-bounds access.

Introduced in: eca96694a7f992be633d48d5ca03cedc9bbc3c9aa (v0.9.8)
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1140724
Reported-by: Luyao Huang <lhuang@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>

(cherry picked from commit 3e745e8f77)
This commit is contained in:
Peter Krempa 2014-09-11 16:35:53 +02:00 committed by Eric Blake
parent 5b3af9c06c
commit 8a07faf337
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/qemu/qemu_driver.c
View File

@ -15766,9 +15766,13 @@ qemuDomainGetBlockIoTune(virDomainPtr dom,
} }
if (flags & VIR_DOMAIN_AFFECT_CONFIG) { if (flags & VIR_DOMAIN_AFFECT_CONFIG) {
int idx = virDomainDiskIndexByName(vm->def, disk, true); int idx = virDomainDiskIndexByName(persistentDef, disk, true);
if (idx < 0) if (idx < 0) {
virReportError(VIR_ERR_INVALID_ARG,
_("disk '%s' was not found in the domain config"),
disk);
goto endjob; goto endjob;
}
reply = persistentDef->disks[idx]->blkdeviotune; reply = persistentDef->disks[idx]->blkdeviotune;
} }