From e4116eaa44cb366b59f7fe98f4b88d04c04970ad Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A1n=20Tomko?= Date: Fri, 18 Sep 2020 17:54:14 +0200 Subject: [PATCH] rpc: require write acl for guest agent in virDomainInterfaceAddresses MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit CVE-2020-25637 Add a requirement for domain:write if source is set to VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT. Signed-off-by: Ján Tomko Reported-by: Ilja Van Sprundel Reviewed-by: Jiri Denemark --- src/libxl/libxl_driver.c | 2 +- src/lxc/lxc_driver.c | 2 +- src/qemu/qemu_driver.c | 2 +- src/remote/remote_protocol.x | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 571b70f982..cbb692d92a 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -6428,7 +6428,7 @@ libxlDomainInterfaceAddresses(virDomainPtr dom, if (!(vm = libxlDomObjFromDomain(dom))) goto cleanup; - if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def) < 0) + if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def, source) < 0) goto cleanup; if (virDomainObjCheckActive(vm) < 0) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index a530488dd2..ec3cb60a78 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -1700,7 +1700,7 @@ lxcDomainInterfaceAddresses(virDomainPtr dom, if (!(vm = lxcDomObjFromDomain(dom))) goto cleanup; - if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def) < 0) + if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def, source) < 0) goto cleanup; if (virDomainObjCheckActive(vm) < 0) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b27f05992b..e158cf85a9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -19004,7 +19004,7 @@ qemuDomainInterfaceAddresses(virDomainPtr dom, if (!(vm = qemuDomainObjFromDomain(dom))) goto cleanup; - if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def) < 0) + if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def, source) < 0) goto cleanup; if (virDomainObjCheckActive(vm) < 0) diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 718829e2d2..f4d6147676 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -6211,6 +6211,7 @@ enum remote_procedure { /** * @generate: none * @acl: domain:read + * @acl: domain:write::source:VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT */ REMOTE_PROC_DOMAIN_INTERFACE_ADDRESSES = 353, -- 2.47.2