Date: Fri, 16 Mar 2018 15:20:28 +0000 (UTC) From: Roman Bogorodskiy <novel@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r464689 - in head/devel/libvirt: . files Message-ID: <201803161520.w2GFKSlR064489@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: novel Date: Fri Mar 16 15:20:28 2018 New Revision: 464689 URL: https://svnweb.freebsd.org/changeset/ports/464689 Log: devel/libvirt: add a fix for QEMU agent denial of service vulnerability Add a fix from upstream master for QEMU agent denial of service (LSN-2018-0004, CVE-2018-1064). Security: https://security.libvirt.org/2018/0004.html Added: head/devel/libvirt/files/patch-src_qemu_qemu__agent.c (contents, props changed) Modified: head/devel/libvirt/Makefile Modified: head/devel/libvirt/Makefile ============================================================================== --- head/devel/libvirt/Makefile Fri Mar 16 14:29:38 2018 (r464688) +++ head/devel/libvirt/Makefile Fri Mar 16 15:20:28 2018 (r464689) @@ -3,7 +3,7 @@ PORTNAME= libvirt PORTVERSION= 4.1.0 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= devel MASTER_SITES= http://libvirt.org/sources/ \ ftp://libvirt.org/libvirt/ Added: head/devel/libvirt/files/patch-src_qemu_qemu__agent.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/devel/libvirt/files/patch-src_qemu_qemu__agent.c Fri Mar 16 15:20:28 2018 (r464689) @@ -0,0 +1,31 @@ +--- src/qemu/qemu_agent.c.orig 2018-02-26 09:02:18 UTC ++++ src/qemu/qemu_agent.c +@@ -53,6 +53,15 @@ VIR_LOG_INIT("qemu.qemu_agent"); + #define DEBUG_IO 0 + #define DEBUG_RAW_IO 0 + ++/* We read from QEMU until seeing a \r\n pair to indicate a ++ * completed reply or event. To avoid memory denial-of-service ++ * though, we must have a size limit on amount of data we ++ * buffer. 10 MB is large enough that it ought to cope with ++ * normal QEMU replies, and small enough that we're not ++ * consuming unreasonable mem. ++ */ ++#define QEMU_AGENT_MAX_RESPONSE (10 * 1024 * 1024) ++ + /* When you are the first to uncomment this, + * don't forget to uncomment the corresponding + * part in qemuAgentIOProcessEvent as well. +@@ -535,6 +544,12 @@ qemuAgentIORead(qemuAgentPtr mon) + int ret = 0; + + if (avail < 1024) { ++ if (mon->bufferLength >= QEMU_AGENT_MAX_RESPONSE) { ++ virReportSystemError(ERANGE, ++ _("No complete agent response found in %d bytes"), ++ QEMU_AGENT_MAX_RESPONSE); ++ return -1; ++ } + if (VIR_REALLOC_N(mon->buffer, + mon->bufferLength + 1024) < 0) + return -1;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803161520.w2GFKSlR064489>