From a1f48bca077e2f3377f29d746efd4310b8a2910f Mon Sep 17 00:00:00 2001 From: Martin Kletzander Date: Thu, 6 Nov 2025 15:43:57 +0100 Subject: [PATCH] libxl: Check ACLs before parsing the whole domain XML MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Utilise the new virDomainDefIDsParseString() for that. Fixes: CVE-2025-12748 Reported-by: Святослав Терешин Signed-off-by: Martin Kletzander Reviewed-by: Michal Privoznik --- src/libxl/libxl_driver.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 107477250a..9dcf2dcf2e 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -1027,13 +1027,18 @@ libxlDomainCreateXML(virConnectPtr conn, const char *xml, if (flags & VIR_DOMAIN_START_VALIDATE) parse_flags |= VIR_DOMAIN_DEF_PARSE_VALIDATE_SCHEMA; - if (!(def = virDomainDefParseString(xml, driver->xmlopt, - NULL, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, driver->xmlopt, parse_flags))) goto cleanup; if (virDomainCreateXMLEnsureACL(conn, def) < 0) goto cleanup; + g_clear_pointer(&def, virDomainDefFree); + + if (!(def = virDomainDefParseString(xml, driver->xmlopt, + NULL, parse_flags))) + goto cleanup; + if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -2813,6 +2818,14 @@ libxlDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag if (flags & VIR_DOMAIN_DEFINE_VALIDATE) parse_flags |= VIR_DOMAIN_DEF_PARSE_VALIDATE_SCHEMA; + if (!(def = virDomainDefIDsParseString(xml, driver->xmlopt, parse_flags))) + goto cleanup; + + if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) + goto cleanup; + + g_clear_pointer(&def, virDomainDefFree); + if (!(def = virDomainDefParseString(xml, driver->xmlopt, NULL, parse_flags))) goto cleanup; @@ -2820,9 +2833,6 @@ libxlDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag if (virXMLCheckIllegalChars("name", def->name, "\n") < 0) goto cleanup; - if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) - goto cleanup; - if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, 0, -- 2.47.3