61 lines
2.1 KiB
Diff
61 lines
2.1 KiB
Diff
|
From 6f5d8671225dc77190647f18a27a0d156d4ca97a Mon Sep 17 00:00:00 2001
|
||
|
|
From: Prasad J Pandit <pjp@fedoraproject.org>
|
||
|
|
Date: Tue, 23 Jul 2019 16:17:52 +0530
|
||
|
|
Subject: [PATCH 1/2] qemu-bridge-helper: restrict interface name to IFNAMSIZ
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
The network interface name in Linux is defined to be of size
|
||
|
|
IFNAMSIZ(=16), including the terminating null('\0') byte.
|
||
|
|
The same is applied to interface names read from 'bridge.conf'
|
||
|
|
file to form ACL rules. If user supplied '--br=bridge' name
|
||
|
|
is not restricted to the same length, it could lead to ACL bypass
|
||
|
|
issue. Restrict interface name to IFNAMSIZ, including null byte.
|
||
|
|
|
||
|
|
This patch fixes CVE-2019-13164.
|
||
|
|
|
||
|
|
Reported-by: Riccardo Schirone <rschiron@redhat.com>
|
||
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
||
|
|
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
Reviewed-by: Li Qiang <liq3ea@gmail.com>
|
||
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||
|
|
(cherry-picked from commit 6f5d8671225dc77190647f18a27a0d156d4ca97a)
|
||
|
|
---
|
||
|
|
qemu-bridge-helper.c | 11 +++++++++++
|
||
|
|
1 file changed, 11 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
|
||
|
|
index 95624bc300..2058e10454 100644
|
||
|
|
--- a/qemu-bridge-helper.c
|
||
|
|
+++ b/qemu-bridge-helper.c
|
||
|
|
@@ -119,6 +119,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list)
|
||
|
|
}
|
||
|
|
*argend = 0;
|
||
|
|
|
||
|
|
+ if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {
|
||
|
|
+ fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));
|
||
|
|
+ fclose(f);
|
||
|
|
+ errno = EINVAL;
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (strcmp(cmd, "deny") == 0) {
|
||
|
|
acl_rule = g_malloc(sizeof(*acl_rule));
|
||
|
|
if (strcmp(arg, "all") == 0) {
|
||
|
|
@@ -269,6 +276,10 @@ int main(int argc, char **argv)
|
||
|
|
usage();
|
||
|
|
return EXIT_FAILURE;
|
||
|
|
}
|
||
|
|
+ if (strlen(bridge) >= IFNAMSIZ) {
|
||
|
|
+ fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));
|
||
|
|
+ return EXIT_FAILURE;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
/* parse default acl file */
|
||
|
|
QSIMPLEQ_INIT(&acl_list);
|
||
|
|
--
|
||
|
|
2.19.1
|
||
|
|
|