From b45f10bc0a2f30ccdbf2cb55da2e4f85b3ebfb23 Mon Sep 17 00:00:00 2001 From: Martin Kletzander Date: Thu, 6 Nov 2025 15:31:12 +0100 Subject: [PATCH] bhyve: Check ACLs before parsing the whole domain XML MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Utilise the new virDomainDefIDsParseString() for that. Fixes: CVE-2025-12748 Reported-by: Святослав Терешин Signed-off-by: Martin Kletzander Reviewed-by: Michal Privoznik --- src/bhyve/bhyve_driver.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 00a484ae21..3a4e83d3d2 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -486,6 +486,15 @@ bhyveDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag if (!caps) return NULL; + /* Avoid parsing the whole domain definition for ACL checks */ + if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + return NULL; + + if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) + return NULL; + + g_clear_pointer(&def, virDomainDefFree); + if ((def = virDomainDefParseString(xml, privconn->xmlopt, NULL, parse_flags)) == NULL) goto cleanup; @@ -493,9 +502,6 @@ bhyveDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag if (virXMLCheckIllegalChars("name", def->name, "\n") < 0) goto cleanup; - if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) - goto cleanup; - if (bhyveDomainAssignAddresses(def, NULL) < 0) goto cleanup; @@ -889,11 +895,17 @@ bhyveDomainCreateXML(virConnectPtr conn, if (flags & VIR_DOMAIN_START_AUTODESTROY) start_flags |= VIR_BHYVE_PROCESS_START_AUTODESTROY; - if ((def = virDomainDefParseString(xml, privconn->xmlopt, - NULL, parse_flags)) == NULL) - goto cleanup; + /* Avoid parsing the whole domain definition for ACL checks */ + if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + return NULL; if (virDomainCreateXMLEnsureACL(conn, def) < 0) + return NULL; + + g_clear_pointer(&def, virDomainDefFree); + + if ((def = virDomainDefParseString(xml, privconn->xmlopt, + NULL, parse_flags)) == NULL) goto cleanup; if (bhyveDomainAssignAddresses(def, NULL) < 0) -- 2.47.3