External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-05 01:22:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

nwfilter: fix crash when counting number of network filters

Browse Source 
The virNWFilterObjListNumOfNWFilters method iterates over the
driver->nwfilters, accessing virNWFilterObj instances. As such
it needs to be protected against concurrent modification of
the driver->nwfilters object.

This API allows unprivileged users to connect, so users with
read-only access to libvirt can cause a denial of service
crash if they are able to race with a call of virNWFilterUndefine.
Since network filters are usually statically defined, this is
considered a low severity problem.

This is assigned CVE-2022-0897.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2022-03-08 17:28:38 +00:00
parent 92e00c7afc
commit a4947e8f63
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/nwfilter/nwfilter_driver.c
View File

@ -478,11 +478,15 @@ nwfilterLookupByName(virConnectPtr conn,
static int
nwfilterConnectNumOfNWFilters(virConnectPtr conn)
{
int ret;
if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
return -1;
return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
virConnectNumOfNWFiltersCheckACL);
nwfilterDriverLock();
ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
virConnectNumOfNWFiltersCheckACL);
nwfilterDriverUnlock();
return ret;
}