b158f13b17
Backport the source patches from the version 7.0.0-3+deb11u3. [https://sources.debian.org/src/libvirt/7.0.0-3%2Bdeb11u3/debian/patches/] Refer to: CVE-2021-3631: https://nvd.nist.gov/vuln/detail/CVE-2021-3631 CVE-2021-3667: https://nvd.nist.gov/vuln/detail/CVE-2021-3667 CVE-2021-3975: https://nvd.nist.gov/vuln/detail/CVE-2021-3975 CVE-2021-4147: https://nvd.nist.gov/vuln/detail/CVE-2021-4147 CVE-2022-0897: https://nvd.nist.gov/vuln/detail/CVE-2022-0897 CVE-2024-1441: https://nvd.nist.gov/vuln/detail/CVE-2024-1441 CVE-2024-2494: https://nvd.nist.gov/vuln/detail/CVE-2024-2494 CVE-2024-2496: https://nvd.nist.gov/vuln/detail/CVE-2024-2496 Test Plan: Pass: downloader Pass: build-pkgs --clean --all Pass: build-image Pass: Debian AIO jenkins installation Closes-Bug: 2078664 Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Change-Id: Ic2c0d6a8208b18ec4d1db2c07fc1fb2508cef183
87 lines
3.4 KiB
Diff
87 lines
3.4 KiB
Diff
From: Dmitry Frolov <frolov@swemel.ru>
|
|
Date: Tue, 12 Sep 2023 15:56:47 +0300
|
|
Subject: interface: fix udev_device_get_sysattr_value return value check
|
|
|
|
Reviewing the code I found that return value of function
|
|
udev_device_get_sysattr_value() is dereferenced without a check.
|
|
udev_device_get_sysattr_value() may return NULL by number of reasons.
|
|
|
|
v2: VIR_DEBUG added, replaced STREQ(NULLSTR()) with STREQ_NULLABLE()
|
|
v3: More checks added, to skip earlier. More verbose VIR_DEBUG.
|
|
|
|
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
|
|
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
|
Origin: https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8
|
|
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2024-2496
|
|
---
|
|
src/interface/interface_backend_udev.c | 26 +++++++++++++++++++-------
|
|
1 file changed, 19 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c
|
|
index 65a5244..74b24e8 100644
|
|
--- a/src/interface/interface_backend_udev.c
|
|
+++ b/src/interface/interface_backend_udev.c
|
|
@@ -23,6 +23,7 @@
|
|
#include <dirent.h>
|
|
#include <libudev.h>
|
|
|
|
+#include "virlog.h"
|
|
#include "virerror.h"
|
|
#include "virfile.h"
|
|
#include "datatypes.h"
|
|
@@ -41,6 +42,8 @@
|
|
|
|
#define VIR_FROM_THIS VIR_FROM_INTERFACE
|
|
|
|
+VIR_LOG_INIT("interface.interface_backend_udev");
|
|
+
|
|
struct udev_iface_driver {
|
|
struct udev *udev;
|
|
/* pid file FD, ensures two copies of the driver can't use the same root */
|
|
@@ -357,11 +360,20 @@ udevConnectListAllInterfaces(virConnectPtr conn,
|
|
const char *macaddr;
|
|
virInterfaceDefPtr def;
|
|
|
|
- path = udev_list_entry_get_name(dev_entry);
|
|
- dev = udev_device_new_from_syspath(udev, path);
|
|
- name = udev_device_get_sysname(dev);
|
|
+ if (!(path = udev_list_entry_get_name(dev_entry))) {
|
|
+ VIR_DEBUG("Skipping interface, path == NULL");
|
|
+ continue;
|
|
+ }
|
|
+ if (!(dev = udev_device_new_from_syspath(udev, path))) {
|
|
+ VIR_DEBUG("Skipping interface '%s', dev == NULL", path);
|
|
+ continue;
|
|
+ }
|
|
+ if (!(name = udev_device_get_sysname(dev))) {
|
|
+ VIR_DEBUG("Skipping interface '%s', name == NULL", path);
|
|
+ continue;
|
|
+ }
|
|
macaddr = udev_device_get_sysattr_value(dev, "address");
|
|
- status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
|
|
+ status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
|
|
|
|
def = udevGetMinimalDefForDevice(dev);
|
|
if (!virConnectListAllInterfacesCheckACL(conn, def)) {
|
|
@@ -976,9 +988,9 @@ udevGetIfaceDef(struct udev *udev, const char *name)
|
|
|
|
/* MTU */
|
|
mtu_str = udev_device_get_sysattr_value(dev, "mtu");
|
|
- if (virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
|
|
+ if (!mtu_str || virStrToLong_ui(mtu_str, NULL, 10, &mtu) < 0) {
|
|
virReportError(VIR_ERR_INTERNAL_ERROR,
|
|
- _("Could not parse MTU value '%s'"), mtu_str);
|
|
+ _("Could not parse MTU value '%s'"), NULLSTR(mtu_str));
|
|
goto error;
|
|
}
|
|
ifacedef->mtu = mtu;
|
|
@@ -1105,7 +1117,7 @@ udevInterfaceIsActive(virInterfacePtr ifinfo)
|
|
goto cleanup;
|
|
|
|
/* Check if it's active or not */
|
|
- status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up");
|
|
+ status = STREQ_NULLABLE(udev_device_get_sysattr_value(dev, "operstate"), "up");
|
|
|
|
udev_device_unref(dev);
|
|
|