diff options
| author | Eric Blake <eblake@redhat.com> | 2014-10-31 22:14:07 -0600 |
|---|---|---|
| committer | Eric Blake <eblake@redhat.com> | 2014-11-10 08:05:15 -0700 |
| commit | f8c771335998f4d7a91b03c11526d819ee470dfc (patch) | |
| tree | e199a167d290bcea31ab5c9da80743299aa97cb9 | |
| parent | 64c04d03ce8d364043e692659220ae1094f1a0cf (diff) | |
| download | libvirt-f8c771335998f4d7a91b03c11526d819ee470dfc.tar.gz | |
CVE-2014-7823: dumpxml: security hole with migratable flag
Commit 28f8dfd (v1.0.0) introduced a security hole: in at least
the qemu implementation of virDomainGetXMLDesc, the use of the
flag VIR_DOMAIN_XML_MIGRATABLE (which is usable from a read-only
connection) triggers the implicit use of VIR_DOMAIN_XML_SECURE
prior to calling qemuDomainFormatXML. However, the use of
VIR_DOMAIN_XML_SECURE is supposed to be restricted to read-write
clients only. This patch treats the migratable flag as requiring
the same permissions, rather than analyzing what might break if
migratable xml no longer includes secret information.
Fortunately, the information leak is low-risk: all that is gated
by the VIR_DOMAIN_XML_SECURE flag is the VNC connection password;
but VNC passwords are already weak (FIPS forbids their use, and
on a non-FIPS machine, anyone stupid enough to trust a max-8-byte
password sent in plaintext over the network deserves what they
get). SPICE offers better security than VNC, and all other
secrets are properly protected by use of virSecret associations
rather than direct output in domain XML.
* src/remote/remote_protocol.x (REMOTE_PROC_DOMAIN_GET_XML_DESC):
Tighten rules on use of migratable flag.
* src/libvirt-domain.c (virDomainGetXMLDesc): Likewise.
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit b1674ad5a97441b7e1bd5f5ebaff498ef2fbb11b)
Conflicts:
src/libvirt-domain.c - file split from older src/libvirt.c; context with older virLibConnError
Signed-off-by: Eric Blake <eblake@redhat.com>
| -rw-r--r-- | src/libvirt.c | 3 | ||||
| -rw-r--r-- | src/remote/remote_protocol.x | 1 |
2 files changed, 3 insertions, 1 deletions
diff --git a/src/libvirt.c b/src/libvirt.c index 27afb740cb..6288e427b1 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -4554,7 +4554,8 @@ virDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) conn = domain->conn; - if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) { + if ((conn->flags & VIR_CONNECT_RO) && + (flags & (VIR_DOMAIN_XML_SECURE | VIR_DOMAIN_XML_MIGRATABLE))) { virLibConnError(VIR_ERR_OPERATION_DENIED, "%s", _("virDomainGetXMLDesc with secure flag")); goto error; diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 225b5ecebe..db3aa8a469 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -2984,6 +2984,7 @@ enum remote_procedure { * @generate: both * @acl: domain:read * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE + * @acl: domain:read_secure:VIR_DOMAIN_XML_MIGRATABLE */ REMOTE_PROC_DOMAIN_GET_XML_DESC = 14, |