mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-10-05 22:05:47 +00:00
nwfilter: fix crash when counting number of network filters
The virNWFilterObjListNumOfNWFilters method iterates over the driver->nwfilters, accessing virNWFilterObj instances. As such it needs to be protected against concurrent modification of the driver->nwfilters object. This API allows unprivileged users to connect, so users with read-only access to libvirt can cause a denial of service crash if they are able to race with a call of virNWFilterUndefine. Since network filters are usually statically defined, this is considered a low severity problem. This is assigned CVE-2022-0897. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
parent
92e00c7afc
commit
a4947e8f63
@ -478,11 +478,15 @@ nwfilterLookupByName(virConnectPtr conn,
|
|||||||
static int
|
static int
|
||||||
nwfilterConnectNumOfNWFilters(virConnectPtr conn)
|
nwfilterConnectNumOfNWFilters(virConnectPtr conn)
|
||||||
{
|
{
|
||||||
|
int ret;
|
||||||
if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
|
if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
|
||||||
return -1;
|
return -1;
|
||||||
|
|
||||||
return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
|
nwfilterDriverLock();
|
||||||
|
ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
|
||||||
virConnectNumOfNWFiltersCheckACL);
|
virConnectNumOfNWFiltersCheckACL);
|
||||||
|
nwfilterDriverUnlock();
|
||||||
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user