From f5ace9c05d59b70d4899199a187cb32ec6f600d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A1n=20Tomko?= Date: Fri, 14 Jun 2019 09:17:39 +0200 Subject: [PATCH 11/11] api: disallow virConnect*HypervisorCPU on read-only connections MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These APIs can be used to execute arbitrary emulators. Forbid them on read-only connections. Fixes: CVE-2019-10168 Signed-off-by: Ján Tomko Reviewed-by: Daniel P. Berrangé (cherry picked from commit bf6c2830b6c338b1f5699b095df36f374777b291) Signed-off-by: Ján Tomko Upstream-Status: Backport CVE: CVE-2019-10168 Signed-off-by: Armin Kuster --- src/libvirt-host.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libvirt-host.c b/src/libvirt-host.c index e20d6ee..2978825 100644 --- a/src/libvirt-host.c +++ b/src/libvirt-host.c @@ -1041,6 +1041,7 @@ virConnectCompareHypervisorCPU(virConnectPtr conn, virCheckConnectReturn(conn, VIR_CPU_COMPARE_ERROR); virCheckNonNullArgGoto(xmlCPU, error); + virCheckReadOnlyGoto(conn->flags, error); if (conn->driver->connectCompareHypervisorCPU) { int ret; @@ -1234,6 +1235,7 @@ virConnectBaselineHypervisorCPU(virConnectPtr conn, virCheckConnectReturn(conn, NULL); virCheckNonNullArgGoto(xmlCPUs, error); + virCheckReadOnlyGoto(conn->flags, error); if (conn->driver->connectBaselineHypervisorCPU) { char *cpu; -- 2.7.4