- Announce - libvirt List Archives

[Libvirt-announce] LSN-2015-0002: small memory leak in ListAll APIs
by Eric Blake 17 Mar '15

17 Mar '15

Libvirt Security Notice: LSN-2015-0002 ====================================== Summary: small memory leak in ListAll APIs Reported on: 20150313 Published on: 20150316 Fixed on: 20150316 Reported by: Eric Blake <eblake(a)redhat.com> Patched by: Eric Blake <eblake(a)redhat.com> Description ----------- The interfaces remoteDispatchConnectListAllDomains, remoteDispatchDomainListAllSnapshots, remoteDispatchDomainSnapshotListAllChildren, remoteDispatchConnectListAllStoragePools, remoteDispatchStoragePoolListAllVolumes, remoteDispatchConnectListAllNetworks, remoteDispatchConnectListAllInterfaces, remoteDispatchConnectListAllNodeDevices, remoteDispatchConnectListAllNWFilters, remoteDispatchConnectListAllSecrets, and remoteDispatchNetworkGetDHCPLeases each have a guarantee that on a successful return, an array with a trailing NULL slot will be allocated, with the array size at least one larger than the return value. However, when using a remote connection where any of these calls returned a result of 0, the allocated array was leaked in the libvirtd server side of the API call. Impact ------ Since each ListAll API call is accessible to read-only clients, a client could repeatedly call the APIs to leak memory and attempt turning it into an out-of-memory denial of service against more privileged clients. In practice, though, since the leak is typically only 8 bytes per API call, an out-of-memory condition is unlikely to occur unless the client is calling the API so frequently as to be obvious that the client is attempting a denial of service long before memory is exhausted, so this vulnerability was not assigned a CVE. Workaround ---------- It is possible to guarantee that a memory leak cannot be escalated into a denial of service attack by preventing read-only connections and avoiding the use of fine-grained Access Control Lists (although this does not prevent the leaks, such a problem is no longer a security attack). Meanwhile, monitoring the libvirtd process for unexpected memory usage can be used to detect if any client is intentionally trying to exploit a memory leak, where restarting libvirtd is effective at avoiding issues where an eventual out-of-memory condition would cause adverse behavior. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Broken in: v1.2.11 Broken in: v1.2.12 Broken in: v1.2.13 Fixed in: v1.2.14 Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: 3c2ff5029b83c9b33be0f1607a3c61f4f5850612 Branch: v1.2.8-maint Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: 4fc4f669eb6a1d776b917d410b6db46e09b6feed Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken in: v1.2.9.2 Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: b9dacdd4d992ba1e5aab2e0189cf64b36a1a7e13 Branch: v1.2.10-maint Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: 70461a11b3410053b89c8c9309e011ce4f62bc07 Branch: v1.2.11-maint Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: b175298be8e92eb3d7883fa3927b97db04d449be Branch: v1.2.12-maint Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: 34538870c770515fc38fa3c71f39e8765113316d Branch: v1.2.13-maint Broken by: 4f25146bf4335cb2b1b31c07dab39e26458bdf61 Fixed by: 117f60ca53eb36aa7751573ac274850bd96a4799 -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[Libvirt-announce] ANNOUNCE: Libvirt Designer version 0.0.2 released
by Daniel P. Berrange 06 Mar '15

06 Mar '15

I'm pleased to announce the second release of the libvirt designer library, version 0.0.2 ftp://ftp.libvirt.org/libvirt/designer/libvirt-designer-0.0.2.tar.gz The release is signed ftp://ftp.libvirt.org/libvirt/designer/libvirt-designer-0.0.2.tar.gz.asc with the GPG key having the fingerprint DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF (4096R) In this release: - Bumped soname & version for ABI change - Remove use of deprecated libosinfo calls - Fix various memory leaks - Treat errors loading the libosinfo DB as non-fatal as some data may be successfully loaded - Improve building of libosinfo short-id from libvirt capabilities information - Expose the libosinfo DB object via a property on the domain object - Don't set PKG_CONFIG_PATH for g-ir-scanner - Auto-generate list of AUTHORS - Avoid redefining _FORTIFY_SOURCE macro - Fix & add gtk-doc introspection annotation - Add Vala APi binding - Add support for floppy & CDROM devices - Use libvirt style libtool versioning csheme - Add API to set list of installed drivers - Add API for querying supported devices - Remove many bogus assumptions in disk bus handling - Populate clock settings, input devices & console - Add API for enabling sound devices - Add AP ifor enabling choice of graphics backends - Add SPICE agent if using SPICE - Add API for enabling USB redirection - Add API for enabling smartcard devices - Add API for enabling video devices - Import latest compiler warnings from gnulib - Avoid using deprecated libvirt-gconfig APIs - Rename virtxml binary to virt-designer - Add API for choosing network backend type - Add further test cases for validing domain builder - Always build test programs The libvirt-designer library builds on top of the libvirt-gconfig and libosinfo libraries, to provide an API that assists applications in building guest domain configurations based on libosinfo policy. The intention is that it be usable from applications such as virt-manager and GNOME boxes which currently duplicate this kind of policy based configuration logic between them. It is still at an early experimental stage of development so it is liable to have further ABI incompatible changes in future releases, which will require recompiling applications and possibly source level changes too. Thanks to all the people who contributed towards this new release. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[Libvirt-announce] Release of libvirt-1.2.13
by Daniel Veillard 02 Mar '15

02 Mar '15

As planned I just made the release for libvirt-1.2.13, it's tagged in git, and signed tarballs and rpms are available at the usual place: ftp://libvirt.org/libvirt/ I also pushed a 1.2.13 for libvirt-python but it's really for completeness as it's virtuallyequivalent to 1.2.12. February is short, that release packs 'only' 220 commits, mostly bug fixes and a fair set of improvment, with the NUMA handling area getting a fairly large update: Features: - a lot of NUMA updates and improvments (Peter Krempa) Documentation: - Add mist.io as libvirt-based application (Michal Privoznik) - Fix typos in messages (Yuri Chornoivan) - Clarify behavior or virDomainDetachDevice (Ján Tomko) - virsh: Add missing parenthesis into man page (Martin Kletzander) - man: moved virsh command cpu-models (Daniel Hansel) - clarify nat range behavior (Ján Tomko) - add page about virtlockd setup (Daniel P. Berrange) - split out sanlock setup docs (Daniel P. Berrange) - Fix version reference in vcpu/iothread scheduling (Martin Kletzander) - S390: Documentation for ccw address type (Stefan Zimmermann) - conf: fix a minor typo (Erik Skultety) - virsh: man: Document behavior of some blkdeviotune's flags when querying (Peter Krempa) Portability: - virprocess: fix MinGW build and RHEL-5 build (Pavel Hrdina) - virutil: fix MinGW build (Pavel Hrdina) - Make tests independant of system page size (Daniel P. Berrange) Bug Fixes: - Really fix XML formatting flags in SaveImageUpdateDef (Ján Tomko) - Ignore listen attribute of <graphics> for type network listens (Ján Tomko) - util: storage: Fix error type in virStorageSourceParseBackingURI (Peter Krempa) - util: storagefile: Don't crash on gluster URIs without path (Peter Krempa) - conf: error out on invalid host id (Luyao Huang) - qemu: fix ifindex array reported to systemd (Laine Stump) - util: check for null ifname inside virNetDevBandwidthSet() (Laine Stump) - network: only clear bandwidth if it has been set (Laine Stump) - Fix error messages in virStorageFileGetMetadataFromFD (Ján Tomko) - Assign default SCSI controller model before checking attribute validity (Ján Tomko) - qemu: Use correct flags for ABI stability check in SaveImageUpdateDef (Michal Privoznik) - qemu: fix memory leak while starting a guest (Pavel Hrdina) - network_conf: Forbid commas in DNS TXT (Michal Privoznik) - qemuMigrationDriveMirror: Listen to events (Michal Privoznik) - qemu: Exit job on error path of qemuDomainSetVcpusFlags() (Peter Krempa) - daemon: Fix segfault by reloading daemon right after start (Pavel Hrdina) - qemu_cgroup: initialize mem_mask to NULL (Pavel Hrdina) - PowerPC : Forbid NULL CPU model with 'host-model' mode. (Prerna Saxena) - qemu: fix vm deadlock when try to use numatune in session mode (Luyao Huang) - virsh: fix IP address in vncdisplay for listen type='network' (Luyao Huang) - libxl: Resolve Coverity CHECKED_RETURN (John Ferlan) - security: Resolve Coverity RESOURCE_LEAK (John Ferlan) - lxc: Fix container cleanup for LXCProcessStart (Luyao Huang) - lxc: Move console checks in LXCProcessStart (Luyao Huang) - security: Refactor virSecurityManagerGenLabel (Erik Skultety) - security: introduce virSecurityManagerCheckAllLabel function (Erik Skultety) - Fix a syntax error in the description text of libvirtd.conf (Zhang Bo) - Allow shrinking of file based volumes (Daniel P. Berrange) - qemu: do upfront check for vcpupids being null when querying pinning (Daniel P. Berrange) - qemu: fix setting of VM CPU affinity with TCG (Daniel P. Berrange) - libxl: disable VNC and SDL until explicitly enabled (Marek Marczykowski-Górecki) - libxl: pass ipaddr to libxl toolstack (Marek Marczykowski-Górecki) - domain: avoid potential memory leak in virDomainGraphicsListenSet*() (Laine Stump) - domain: backfill listen address to parent <graphics> listen attribute (Laine Stump) - virsh: fix IP address in domdisplay for listen type='network' (Luyao Huang) - bhyvexml2argvmock: change int to size_t for tapfdSize (Pavel Hrdina) - qemu: fix crash when migrateuri has no scheme (Luyao Huang) - conf: Fix libvirtd crash and memory leak caused by virDomainVcpuPinDel() (Zhang Bo) - conf: forbid seclabel duplicates for domain devices (Erik Skultety) - Fix qemu job handling in SetSchedulerParameters (Ján Tomko) - conf: disallow invalid values for video attributes (Martin Kletzander) - Clear dynamic seclabels on LXCProcessStart failure (Cédric Bosdonnat) - network: don't allow multiple portgroups with the same name in a network (Laine Stump) - Error out when custom tap device path makes no sense (Ján Tomko) - Only parse custom vhost path for virtio interfaces (Ján Tomko) - Trivially support DomainHasManagedSaveImage (Ján Tomko) - libxl: update dom->id in libxlDomainCreateWithFlags (Marek Marczykowski-Górecki) - qemu: Properly report error on uuid mismatch in the migration cookie (Luyao Huang) - lxc: fix double close handshakefds[1] (Luyao Huang) - util: storage: Fix parsing of nbd:// URI without path (Peter Krempa) - conf: Properly report error of unsupported input bus type (Luyao Huang) - conf: Properly report error when an unsupported chr device name is passed (Luyao Huang) - virnetdev: fix some issues found by coverity and mingw builds (Pavel Hrdina) - storage: Need to clear pool prior to refreshPool during Autostart (John Ferlan) - qemu: command: Don't combine old and modern NUMA node creation (Peter Krempa) - xend: Don't crash in virDomainXMLDevID (Michal Privoznik) - conf: Don't mangle vcpu placement randomly (Michal Privoznik) - qemu: Don't unconditionally delete file in qemuOpenFileAs (John Ferlan) - virfile: Need to check for ENOTCONN from recvfd failure (John Ferlan) - Remove flag checking in MacVLanCreate helper stub (Ján Tomko) - storage: Check the partition name against provided name (John Ferlan) - storage: Fix check for partition type for disk backing volumes (John Ferlan) - qemu: fix cannot set graphic passwd via qemuDomainSaveImageDefineXML (Luyao Huang) - hotplug: only add a chardev to vmdef after monitor call (Ján Tomko) - systemd: don't report an error if the guest is already terminated (Daniel P. Berrange) Improvements: - conf: error out on missing dhcp host attributes (Ján Tomko) - schema: Allow interleaving the /domain/os/type element (Peter Krempa) - schema: Add virtio-mmio address type into RNG (Martin Kletzander) - cpu: Format <cpu/> properly (Michal Privoznik) - virCPUDefFormatBufFull: Use our general error handling pattern (Michal Privoznik) - util: Introduce virBufferAddBuffer (Michal Privoznik) - Rework s390 architecture checking (Stefan Zimmermann) - Prevent default creation of usb controller on s390 and s390x (Stefan Zimmermann) - po: Add config file for zanata (Daniel P. Berrange) - libvirt-guests: Allow time sync on guests resume (Michal Privoznik) - qemu: Fix AAVMF/OVMF #define names (Cole Robinson) - libxl: support backend domain setting for disk and net devices (Marek Marczykowski) - conf: support backend domain name in disk and network devices (Marek Marczykowski) - network: allow <pf> together with <interface>/<address> in network status (Laine Stump) - qemu: caps: Add capability bit for the "pc-dimm" device (Peter Krempa) - conf: Hoist validation of memory size into the post parse callback (Peter Krempa) - conf: numa: Check ABI stability of NUMA configuration (Peter Krempa) - conf: ABI: Hugepage backing definition is not guest ABI (Peter Krempa) - conf: Move all NUMA configuration to virDomainNuma (Peter Krempa) - conf: numa: Add setter/getter for NUMA node memory size (Peter Krempa) - conf: numa: Add accessor to NUMA node's memory access mode (Peter Krempa) - conf: numa: Add accessor for the NUMA node cpu mask (Peter Krempa) - conf: numa: Add helper to get guest NUMA node count and refactor users (Peter Krempa) - qemu: command: Unify retrieval of NUMA cell count in qemuBuildNumaArgStr (Peter Krempa) - conf: numa: Don't pass double pointer to virDomainNumatuneParseXML (Peter Krempa) - numa: conf: Tweak parameters of virDomainNumatuneSet (Peter Krempa) - conf: numa: Always allocate the NUMA config (Peter Krempa) - conf: Allocate domain definition with the new helper (Peter Krempa) - conf: Separate helper for creating domain objects (Peter Krempa) - conf: numa: Format <numatune> XML only if necessary (Peter Krempa) - conf: numa: Refactor logic in virDomainNumatuneParseXML (Peter Krempa) - conf: numa: Reformat virDomainNumatuneParseXML (Peter Krempa) - conf: numa: Improve error message in case a numa node doesn't have cpus (Peter Krempa) - conf: numa: Recalculate rather than remember total NUMA cpu count (Peter Krempa) - conf: Move enum virMemAccess to the NUMA code and rename it (Peter Krempa) - conf: numa: Rename virDomainNumatune to virDomainNuma (Peter Krempa) - conf: Move NUMA cell formatter to numa_conf (Peter Krempa) - conf: numa: Don't duplicate NUMA cell cpumask (Peter Krempa) - conf: Refactor virDomainNumaDefCPUParseXML (Peter Krempa) - conf: Move NUMA cell parsing code from cpu conf to numa conf (Peter Krempa) - conf: Move numatune_conf to numa_conf (Peter Krempa) - virsh: fix vcpupin info (Pavel Hrdina) - virQEMUCapsCacheLookupCopy: Filter qemuCaps based on machineType (Michal Privoznik) - virQEMUCapsCacheLookupCopy: Pass machine type (Michal Privoznik) - virsh-edit: Make force editing usable (Martin Kletzander) - parallels: Set the first HDD from XML as bootable (Mikhail Feoktistov) - parallels: Use IS_CT() macro instead of STREQ("exe") (Mikhail Feoktistov) - parallels: code aligment (Mikhail Feoktistov) - Search for schemas and cpu_map.xml in source tree (Jiri Denemark) - qemuProcessHandleBlockJob: Take status into account (Michal Privoznik) - qemuProcessHandleBlockJob: Set disk->mirrorState more often (Michal Privoznik) - PowerPC : Make 'qemu-system-ppc64' the default emulator on ppc64[le]. (Prerna Saxena) - qemuBuildMemoryBackendStr: Report backend requirement more appropriately (Michal Privoznik) - qemuxml2argvtest: Fake response from numad (Michal Privoznik) - numatune_conf: Expose virDomainNumatuneNodeSpecified (Michal Privoznik) - lxc: Modify/add some debug messages (John Ferlan) - Wire up mrg_rxbuf option for qemu (Ján Tomko) - Add mrg_rxbuf option to virtio interfaces (Ján Tomko) - virsh attach-interface: Allow macvtap hotplug (Michal Privoznik) - virsh attach-interface: Use virDomainNetType{From,To}String() (Michal Privoznik) - virsh attach-interface: Use enum instead of arbitrary integers (Michal Privoznik) - libvirt_private.syms: Expose virDomainNetTypeFromString (Michal Privoznik) - qemu: Add support for setting vCPU and I/O thread scheduler setting (Martin Kletzander) - docs, schema, conf: Add support for setting scheduler parameters of guest threads (Martin Kletzander) - util: Add virProcessSetScheduler() function for scheduler settings (Martin Kletzander) - domain: include portgroup in interface status xml (Laine Stump) - qemu: qemuOpenFileAs - set flag VIR_FILE_OPEN_FORCE_MODE (John Ferlan) - virfile: Adjust error path for virFileOpenForked (John Ferlan) - schema: allow multiple seclabel for devices in domaincommon.rng (Erik Skultety) - qemu: Implement random number generator hotunplug (Luyao Huang) - qemu: Implement random number generator hotplug (Luyao Huang) - qemu: Implement random number generator cold (un)plug (Peter Krempa) - conf: Add helpers to insert/remove/find RNG devices in domain def (Luyao Huang) - audit: export virDomainAuditRNG (Luyao Huang) - qemu: command: Refactor creation of RNG device commandline (Peter Krempa) - qemu: command: Break some very long lines in qemuBuildRNGDevStr() (Peter Krempa) - qemu: command: Shuffle around formatting of alias for RNG device backend (Peter Krempa) - qemu: command: Make RNG backend device IDs unique (Luyao Huang) - qemu: refactor qemuBuildRNGDeviceArgs to allow reuse in RNG hotplug (Luyao Huang) - qemu: Add helper to assign RNG device aliases (Luyao Huang) - conf: Introduce helper to find duplicate device address (Peter Krempa) - S390: ccw support for virsh attach-disk address parameter (Stefan Zimmermann) - maint: improve usage of autogen's --no-git (Stefan Zimmermann) - qemu: include libvirt & QEMU versions in QEMU log files (Daniel P. Berrange) - nodedev: check/add for scsi_host caps for NumOfCaps and ListCaps (John Ferlan) - nodedev: check/add for scsi_host caps for ListDevices (Shivaprasad G Bhat) - cpu: add Freescale ppc64 CPU models (Olivia Yin) - tests: virstoragetest: Switch backing chain test to use automatic numbering (Peter Krempa) - virsh-volume: add support for --reflink (Chen Hanxiao) - util: make virNetDev(Get|Set)IFFlags() static (Laine Stump) - qemu: command: Refactor NUMA backend object formatting to use JSON objs (Peter Krempa) - qemu: command: Switch to bytes when formatting size for memory backends (Peter Krempa) - qemu: command: Unify values for boolean values when formating memory backends (Peter Krempa) - qemu: command: Shuffle around formating of alias for memory backend objs (Peter Krempa) - qemu: Extract code to setup memory backing objects (Peter Krempa) - qemu: command: Add helper to format -object strings from JSON representation (Peter Krempa) - util: json: add helper to iterate JSON object key=value pairs (Peter Krempa) - util: json: Add functions to convert JSON arrays from/to virBitmaps (Peter Krempa) - util: bitmap: Add option to allocate bitmap without reporting error (Peter Krempa) - util: json: make value object creator universal by supporting adding (Peter Krempa) - test: utils: Add helpers for automatic numbering of test cases (Peter Krempa) - conf: numatune: Extract code for requesting memory nodeset from formatting (Peter Krempa) - qemu: change macvtap device options in response to NIC_RX_FILTER_CHANGED (Tony Krowiak) - util: Functions for getting/setting device options (Tony Krowiak) - qemu: Adjust EndAsyncJob for qemuDomainSaveInternal error path (John Ferlan) - schemas: Allow all generic elements and attributes for all interfaces (Michal Privoznik) - qemu: Add AAVMF to the list of known UEFIs (Michal Privoznik) - qemu: Allow UEFI paths to be specified at compile time (Michal Privoznik) - Fix syntax-check (Ján Tomko) - util: bitmap: Tolerate NULL bitmaps in virBitmapEqual (Peter Krempa) - storage: When delete extended partition, need to refresh pool (John Ferlan) - storage: Adjust how to refresh extended partition disk data (John Ferlan) - storage: Attempt error recovery in virStorageBackendDiskCreateVol (John Ferlan) - storage: Move virStorageBackendDiskDeleteVol (John Ferlan) - libvirt.spec: remove vbox storage and network .so files (Pavel Hrdina) - Split qemuDomainChrInsert into two parts (Ján Tomko) - lxc: report veth device indexes to systemd (Daniel P. Berrange) - lxc: more logging during startup paths (Daniel P. Berrange) - lxc: delay setup of cgroup until we have the init pid (Daniel P. Berrange) - lxc: only write XML once for lxc controller (Daniel P. Berrange) - lxc: re-arrange startup synchronization sequence with controller (Daniel P. Berrange) - lxc: don't build pidfile string multiple times (Daniel P. Berrange) - qemu: report TAP device indexes to systemd (Daniel P. Berrange) - Fix shadowed variable warning (Ján Tomko) - storage: add a flag to clone files on btrfs (Chen Hanxiao) - storage: introduce btrfsCloneFile() for COW copy (Chen Hanxiao) - Removing probing of secondary drivers (Daniel P. Berrange) - don't disable state driver when libvirtd is not built (Daniel P. Berrange) - Remove all secondary driver private data fields (Daniel P. Berrange) - Remove use of interfacePrivateData from udev driver (Daniel P. Berrange) - Remove use of nodeDevicePrivateData from nodeDev driver (Daniel P. Berrange) - Remove use of storagePrivateData/networkPrivateData from vbox (Daniel P. Berrange) - Remove use of nwfilterPrivateData from nwfilter driver (Daniel P. Berrange) - Remove use of secretPrivateData from secret driver (Daniel P. Berrange) - qemu: Fix job handling in qemuDomainSetMetadata (Peter Krempa) - qemu: Fix job type in qemuDomainGetBlockIoTune (Peter Krempa) - qemu: Fix job handling in qemuDomainSetSchedulerParametersFlags (Peter Krempa) - qemu: Fix job handling in qemuDomainSetMemoryParameters (Peter Krempa) - qemu: Fix job handling in qemuDomainSetAutostart (Peter Krempa) - qemu: Fix job handling in qemuDomainPinEmulator (Peter Krempa) - qemu: Fix job handling in qemuDomainPinVcpuFlags (Peter Krempa) So thanks everyone for the help with this release, be it with reports, patches, reviews or documentation ! Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[Libvirt-announce] Entering freeze for libvirt-1.2.13
by Daniel Veillard 26 Feb '15

26 Feb '15

As suggested yesterday, and hearing no opposition, I have just tagged Redlease Candidate 1 for libvirt-1.2.13 in git and signed tarballs and rpms for it available at the usual place: ftp://libvirt.org/libvirt/ Based on my own but minimal testing this seems to work, but obviously please give it a try so we can squash bugs and portability issues in time. A candidate release 2 on Thursday and a final 1.2.13 release next Monday is the schedule assumeing no major issue is found, so please give it a test ! Thanks, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[Libvirt-announce] ANNOUNCE: libvirt 1.2.9.2 maintenance release
by Cole Robinson 08 Feb '15

08 Feb '15

libvirt 1.2.9.2 is now available. This is a maintenance release of libvirt 1.2.9 with additional bugfixes that have accumulated upstream since the initial release. This release can be downloaded at: http://libvirt.org/sources/stable_updates/libvirt-1.2.9.2.tar.gz Changes in this version: * util: storage: Fix parsing of nbd:// URI without path * qemu: fix domain startup failing with 'strict' mode in numatune * storage: Need to clear pool prior to refreshPool during Autostart * xend: Don't crash in virDomainXMLDevID * CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots * CVE-2015-0236: qemu: Check ACLs when dumping security info from save image * conf: goto error when value of max_sectors is too large * Fix hotplugging of block device-backed usb disks * conf: fix crash when hotplug a channel chr device with no target * qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs * storage: fix crash caused by no check return before set close * qemu: bulk stats: Fix logic in monitor handling * CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() * qemu: Drop OVMF whitelist * qemu: Support OVMF on armv7l aarch64 guests For info about past maintenance releases, see: http://wiki.libvirt.org/page/Maintenance_Releases Thanks, Cole

1 0

[Libvirt-announce] ANNOUNCE: libvirt 1.1.3.9 maintenance release
by Cole Robinson 08 Feb '15

08 Feb '15

libvirt 1.1.3.9 is now available. This is a maintenance release of libvirt 1.1.3 with additional bugfixes that have accumulated upstream since the initial release. This release can be downloaded at: http://libvirt.org/sources/stable_updates/libvirt-1.1.3.9.tar.gz Changes in this version: * CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots * CVE-2015-0236: qemu: Check ACLs when dumping security info from save image * qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs For info about past maintenance releases, see: http://wiki.libvirt.org/page/Maintenance_Releases Thanks, Cole

1 0

[Libvirt-announce] Release of libvirt-1.2.12
by Daniel Veillard 27 Jan '15

27 Jan '15

As planned I pushed the libvirt-1.2.12 release as well as the corresponding python bindings to the server, they are also tagged in git(s): ftp://libvirt.org/libvirt [/python] This is a mixed release, not really a huge feature addition though there should be user noticeable improvement for networking and users of Parallels. 2 secutity fixes, a large set of bug fixes and lot of improvements: Security: - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (Peter Krempa) - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (Peter Krempa) Documentation: - Fix docs about python bindings package (Martin Kletzander) - Document some -boot option limitations on UEFI (Michal Privoznik) - virsh.pod: Update description (John Ferlan) - Fix typo s/interpetation/interpretation/ (Claudio Bley) - split typedef and struct definition for apibuild.py (Claudio Bley) Portability: - Fix build with older gcc (Ján Tomko) - Fix virCgroupNewMachine prototype on non-Linux (Ján Tomko) - Conditionalize use of -Wno-suggest-attribute=format pragma (Daniel P. Berrange) - virnetlink: fix build on non-Linux (Eric Blake) - util: Fix fallocate stubs for mingw build (Martin Kletzander) - avoid using deprecated udev logging functions (Daniel P. Berrange) Bug Fixes: - Fix a memory leak in virCgroupGetPercpuStats (Ján Tomko) - Use correct location for qcow1 encryption header (Ján Tomko) - systemd: fix build without dbus (Daniel P. Berrange) - Fix apparmor issues for tck (Mike Latimer) - Fix apparmor issues for Xen (Mike Latimer) - esx_vi: fix possible segfault (Pavel Hrdina) - xenapi_driver: fix copy-paste typo (Pavel Hrdina) - Fix virCgroupGetPercpuStats with non-continuous present CPUs (Ján Tomko) - qemu: output error when try to hotplug unsupported console type (Luyao Huang) - qemu: format server interface without a listen address (Ján Tomko) - tests: fix xlconfigtest build failure (Jim Fehlig) - qemu_conf: check for duplicate security drivers (Ján Tomko) - Always check return value of qemuDomainObjExitMonitor (Ján Tomko) - Fix vmdef usage after domain crash in monitor on device attach (Ján Tomko) - Fix vmdef usage after domain crash in monitor on device detach (Ján Tomko) - libxl: Set path to console on domain startup. (Anthony PERARD) - Coverity fix: properly check for 0 ipv6 address. (Cédric Bosdonnat) - network: Resolve Coverity FORWARD_NULL (John Ferlan) - qemu: Tweak auto adding PCI bridge controller when extending default PCI bus (Erik Skultety) - domain_conf: Check errors from virSocketAddrFormat (John Ferlan) - domain_conf: Resolve Coverity RESOURCE_LEAK (John Ferlan) - Fix ipv6 regex in RNG schemas to match '::' (Cédric Bosdonnat) - virNetworkDefUpdateIPDHCPHost: Don't crash when updating network (Michal Privoznik) - qemu: free priv->origname when qemuMigrationPrepareAny fails (Luyao Huang) - Fix vmdef usage while in monitor in qemu process (Ján Tomko) - Fix vmdef usage while in monitor in BlockStat* APIs (Ján Tomko) - Fix vmdef usage while in monitor in qemuDomainHotplugVcpus (Ján Tomko) - qemu_driver: fix setting vcpus for offline domain (Pavel Hrdina) - qemu: snapshot: inactive external snapshot can't work after libvirtd restart (Shanzhi Yu) - qemu: forbid second blockcommit during active commit (Eric Blake) - parallels: don't override error message when XML parsing fails (Daniel P. Berrange) - Don't use VIR_DOMAIN_XML_SECURE when parsing XML (Daniel P. Berrange) - conf: fix crash when hotplug a channel chr device with no target (Luyao Huang) - qemuxml2argvtest: Fix test after change of qxl vgamem_mb default (Michal Privoznik) - cpu: Bugfix for s390 CPU driver to return a host CPU model (Daniel Hansel) - virconf: Resolve a possible memory leak in virConfSetValue (John Ferlan) - openvz: Resolve Coverity RESOURCE_LEAK (John Ferlan) - lxc: Don't crash on NULL ifname_guest_actual (Guido Günther) - conf: Correctly format controller's driver (Luyao Huang) - vmx: Fix a VMX parsing problem (Geoff Hickey) - qemu: Fix system pages handling in <memoryBacking/> (Michal Privoznik) - qemu: Don't unref domain after exit from nested async job (Peter Krempa) - conf: Don't format actual network definition in migratable XML (Luyao Huang) - qemu: Restore old bandwidth rules when setting new fails (Luyao Huang) - Fix error when starting a container after an error (Cédric Bosdonnat) - qemu: Fix coverity issues after refcount refactoring (Martin Kletzander) - util: Fix possible NULL dereference (Martin Kletzander) - disable vCPU pinning with TCG mode (Daniel P. Berrange) - Don't setup fake CPU pids for old QEMU (Daniel P. Berrange) - Fix hotplugging of block device-backed usb disks (Ján Tomko) - Buffer size too small when reading sysinfo (Boris Fiuczynski) - qemu: fix memory leak in blockinfo (Eric Blake) - conf: fix cannot start a guest have a shareable network iscsi hostdev (Luyao Huang) - qemu: fix bugs in blockstats (Eric Blake) - qemu: Free saved error in qemuDomainSetVcpusFlags (Martin Kletzander) - qemu: Add missing goto error in qemuRestoreCgroupState (Martin Kletzander) - conf: Fix invalid condition when parsing storage owner (Martin Kletzander) - qemu: Fix hotplugging cpus with strict memory pinning (Martin Kletzander) - parallels: fix usage of disk->info.addr.drive structure (Dmitry Guryanov) - qemu: Auto generate a controller when attach hostdev and chr device (Luyao Huang) - xenconfig: fix boot device parsing (Wei Liu) - conf: fix virDomainLeaseIndex logic (Luyao Huang) - conf: Fix libvirtd crash matching hostdev XML (Luyao Huang) - fix typo in sanlock driver s/VIR_CONF_UONG/VIR_CONF_ULONG/ (Daniel P. Berrange) - qemu: avoid rare race when undefining domain (Martin Kletzander) Improvement: - tests: Check for virQEMUDriverConfigNew return value (Michal Privoznik) - systemd: avoid string comparisons on dbus error messages (Daniel P. Berrange) - aarch64: Support versioned machine types. (Richard W.M. Jones) - qemu: Add check for PCI bridge placement if there are too many PCI devices (Erik Skultety) - qemu: Fix auto-adding PCI bridge when all slots are reserved (Erik Skultety) - qemu: move PCI slot assignment for PIIX3, Q35 into a separate function (Erik Skultety) - qemu: reorder PCI slot assignment functions (Erik Skultety) - schemas: Move definition of 'hexuint' to basictypes (Peter Krempa) - util: json: Make argument of virJSONValueArraySize const (Peter Krempa) - qemu: command: Honor const-correctnes in qemuBuildNumaArgStr (Peter Krempa) - conf: Fix comment mentioning actual type of @multi member of virDevicePCIAddress (Peter Krempa) - Grant access to helpers (Mike Latimer) - conf: virDomainDefMaybeAddController tweak return code (Erik Skultety) - qemu: Remove dead code in qemuDomainAssignPCIAddresses revert patch (Erik Skultety) - network: Let domains be restricted to local DNS (Josh Stone) - Make ZFS storage pool XML tests optional (Gary R Hook) - Simplify condition for formatting CPU features (Ján Tomko) - Add an XML test for host-model CPU with features (Ján Tomko) - parallels: create container from existing image (Dmitry Guryanov) - parallels: allow to add filesystems to container (Dmitry Guryanov) - parallels: commit with PVCF_DETACH_HDD_BUNDLE flag (Dmitry Guryanov) - parallels: dump info about container filesystems (Dmitry Guryanov) - add ploop fs driver type (Dmitry Guryanov) - qemu: Add support for enabling/disabling PMU (Martin Kletzander) - docs, schema, conf: Add support for PMU feature (Martin Kletzander) - virsh: add support for domain XML validation (Daniel P. Berrange) - Add XML test for too many PCI devices on default PCI bus (Erik Skultety) - Remove dead code in qemuDomainAssignPCIAddresses (Erik Skultety) - virSocketAddrGetIpPrefix 0.0.0.0 and :: special cases (Cédric Bosdonnat) - Use the network route definitions for domains (Cédric Bosdonnat) - Move code related to network routes to networkcommon_conf.[ch] (Cédric Bosdonnat) - Move network route definition to networkcommon.rng (Cédric Bosdonnat) - Add support for schema validation when passing in XML (Daniel P. Berrange) - Add virXMLValidateAgainstSchema helper method (Daniel P. Berrange) - Change int to size_t in size var for tap/vhost FDs (Daniel P. Berrange) - Log dtrace/systemd probes at INFO level instead of DEBUG (Daniel P. Berrange) - Add systemd/dtrace probes for DBus APIs (Daniel P. Berrange) - Add support for systemd-machined CreateMachineWithNetwork (Daniel P. Berrange) - Mark the domain as active in qemuhotplugtest (Ján Tomko) - Check for domain liveness in qemuDomainObjExitMonitor (Ján Tomko) - check IOMMU group devices usage when preparing device for vfio passthrough (Shivaprasad G Bhat) - virpci: Implement virPCIDeviceGetAddress function (Shivaprasad G Bhat) - libxl: Add support for parsing/formating Xen XL config (Kiarie Kahurani) - tests: Tests for the xen-xl parser (Kiarie Kahurani) - Introduce support for parsing/formatting Xen xl config format (Jim Fehlig) - qemu_process: detect updated video ram size values from QEMU (Pavel Hrdina) - qemu_monitor: introduce new function to get QOM path (Pavel Hrdina) - qemu, lxc: Warn if setting QoS on unsupported vNIC types (Michal Privoznik) - conf: Increase virNetDevBandwidthParse intelligence (Michal Privoznik) - Give virDomainDef parser & formatter their own flags (Daniel P. Berrange) - Decouple CPU XML formatting from domain XML public API flags (Daniel P. Berrange) - formatdomaincaps: Correctly format API reference (Michal Privoznik) - Fix flags passed to virDomainDefParseString by XenAPI driver (Daniel P. Berrange) - Add stub virDomainDefineXMLFlags impls (Daniel P. Berrange) - Add new virDomainDefineXMLFlags public API (Daniel P. Berrange) - qemu: Allow enabling/disabling features with host-passthrough (Martin Kletzander) - lxc: Move setting ifname_guest_actual to virLXCSetupInterfaces (Guido Günther) - openvz: Check errors from virSocketAddrFormat (John Ferlan) - qxl: change the default value for vgamem_mb to 16 MiB (Pavel Hrdina) - virsh: Emit error for VSH_OT_DATA without VSH_OFLAG_REQ (Hao Liu) - safezero: fall back to writing zeroes even when resizing (Ján Tomko) - maint: in src/Makefile.am, $(top_srcdir)/src is verbose (Eric Blake) - nwfilter: Add support for icmpv6 filtering (Stefan Berger) - Parallels: Add VNC hostname setup (Alexander Burluka) - qemu: fix miss goto cleanup in qemuDomainAttachNetDevice (Luyao Huang) - networkGetDHCPLeases: Remove unnecessary error reporting (Nehal J Wani) - qemu: use a wrong name for guest panic status (Luyao Huang) - maint: update to latest gnulib (Eric Blake) - Report error if a driver can't handle multiple IP addresses (Cédric Bosdonnat) - Openvz --ipadd can be provided multiple times (Cédric Bosdonnat) - LXC: honour network devices link state (Cédric Bosdonnat) - LXC: use the new net devices routes definition (Cédric Bosdonnat) - lxc conf2xml: convert lxc.network.ipv[46].gateway (Cédric Bosdonnat) - Domain network devices can now have a <route> element (Cédric Bosdonnat) - lxc conf2xml: convert ip addresses for hostdev NICs (Cédric Bosdonnat) - Allow network capabilities hostdev to configure IP addresses (Cédric Bosdonnat) - lxc conf2xml: convert IP addresses (Cédric Bosdonnat) - LXC: set IP addresses to veth devices in the container (Cédric Bosdonnat) - Domain conf: allow more than one IP address for net devices (Cédric Bosdonnat) - Renamed virNetDevClearIPv4Address to virNetDevClearIPAddress (Cédric Bosdonnat) - virNetDevClearIPv4Address: netlink implementation (Cédric Bosdonnat) - virNetDevAddRoute: implementation using netlink (Cédric Bosdonnat) - Renamed virNetDevSetIPv4Address to virNetDevSetIPAddress (Cédric Bosdonnat) - virNetDevSetIPv4Address: libnl implementation (Cédric Bosdonnat) - Forgot to cleanup ifname_guest* in domain network def parsing (Cédric Bosdonnat) - maint: fix date in local gnulib patch (Daniel P. Berrange) - maint: update to latest gnulib (Daniel P. Berrange) - Teach AppArmor, that /usr/lib64 may exist. (Cedric Bosdonnat) - Add tests to xmconfigtest (Chunyan Liu) - xenconfig: set HVM pae/apic/acpi/ default to 1 (Chunyan Liu) - src/xenconfig: Export helper functions (Kiarie Kahurani) - capabilities: Format <domain/> properly (Michal Privoznik) - parallels: report, that cdrom image is raw (Dmitry Guryanov) - tests: Set up two more overrides for root builders (Martin Kletzander) - test: fix nwfilter tests following changes in virfirewall.c (Stefan Berger) - qemu: completely rework reference counting (Martin Kletzander) - maint: update .mailmap (Claudio Bley) - qemu: Create memory-backend-{ram,file} iff needed (Michal Privoznik) - Remove redundant cleanup in qemuDomainAttachVirtioDiskDevice (Ján Tomko) - Fix error message on redirdev caps detection (Ján Tomko) - logical: Add "--type snapshot" to lvcreate command (John Ferlan) - getstats: crawl backing chain for qemu (Eric Blake) - getstats: split block stats reporting for easier recursion (Eric Blake) - getstats: add new flag for block backing chain (Eric Blake) - getstats: prepare for dynamic block.count stat (Eric Blake) - getstats: report block sizes for offline domains (Eric Blake) - qemu: refactor blockinfo data gathering (Eric Blake) - getstats: rearrange blockinfo gathering (Eric Blake) - getstats: perform recursion in monitor collection (Eric Blake) - getstats: prepare monitor collection for recursion (Eric Blake) - qemu: let blockinfo reuse virStorageSource (Eric Blake) - qemu: refactor blockinfo job handling (Eric Blake) - build: fix typo in previous patch (Eric Blake) - virstoragefile: Have virStorageFileResize use safezero (John Ferlan) - virfile: Refactor safezero (John Ferlan) - conf: Rework virDomainObjListFindByUUID to allow more concurrent APIs (Martin Kletzander) - storage: unify permission formatting (Martin Kletzander) - qemu: Leave cpuset.mems in parent cgroup alone (Martin Kletzander) - qemu: Save numad advice into qemuDomainObjPrivate (Martin Kletzander) - qemu: Remove unnecessary qemuSetupCgroupPostInit function (Martin Kletzander) - util: Add virNumaGetHostNodeset (Martin Kletzander) - util: Add function virCgroupHasEmptyTasks (Martin Kletzander) - spec: Fix syntax (Jiri Denemark) - spec: Disable -Werror in Fedora RPM builds (Daniel P. Berrange) - parallels: set format for real disk devices (Dmitry Guryanov) - parallels: support NULL virDomainVideoAccelDefPtr (Dmitry Guryanov) - qemu: add/remove bridge fdb entries as guest CPUs are started/stopped (Laine Stump) - qemu: make persistent update of graphics device supported (Wang Rui) - qemu: fix alignment of qemuDomainFindGraphics (Wang Rui) - qemu: report properer error number when change graphics failed (Wang Rui) - qemu: Allow system pages to <memoryBacking/> (Michal Privoznik) - virconf: Introduce VIR_CONF_ULONG (Michal Privoznik) - virConfType: switch to VIR_ENUM_{DECL,IMPL} (Michal Privoznik) - virConfSetValue: Simplify condition (Michal Privoznik) - conf: move the check for secondary consoles of targetType serial (Erik Skultety) - qemu: add a qemuInterfaceStopDevices(), called when guest CPUs stop (Laine Stump) - qemu: always call qemuInterfaceStartDevices() when starting CPUs (Laine Stump) - conf: Ignore device address for model=none usb controller and memballon (Luyao Huang) Cleanup: - Indentation (Ján Tomko) Thanks everybody for helping with this release, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[Libvirt-announce] Entering freeze for libvirt-1.2.12
by Daniel Veillard 24 Jan '15

24 Jan '15

As planned I tagged the release candidate 1 in git and pushed signed tarballs and rpms to the usual place: ftp://libvirt.org/libvirt/ Seems to work fine for me, but my testing is limited. Give it a try especially on other architectures or OSes. Plan is to release an rc2 by the dn of the week and the final next Tuesday assuming everythings goes smoothly ! thanks, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[Libvirt-announce] LSN-2015-0001: CVE-2015-0236 snapshots and save images leak VNC passwords
by Eric Blake 22 Jan '15

22 Jan '15

Libvirt Security Notice: LSN-2015-0001 ====================================== Summary: snapshots and save images leak VNC passwords Reported on: 20150120 Published on: 20150122 Fixed on: 20150122 Reported by: Luyao Huang <lhuang(a)redhat.com> Patched by: Peter Krempa <pkrempa(a)redhat.com> See also: CVE-2015-0236 Description ----------- The two interfaces virDomainSnapshotGetXMLDesc and virDomainSaveImageGetXMLDesc would accept the VIR_DOMAIN_XML_SECURE flag in situations where virDomainGetXMLDesc did not, when fine-grained access control lists (ACL) are in use. As a result, a client can use a snapshot or save image to bypass restrictions and gain access to the secured information. Impact ------ A client using a read-write connection, and which has the 'domain:read' ACL privilege while lacking 'domain:secure_read', can trigger an information leak of data by using VIR_DOMAIN_XML_SECURE with the affected interfaces. Fortunately, the only data in this category is the value of an optional VNC password. Workaround ---------- VNC passwords are notoriously weak (they are capped at an 8 byte maximum length; the VNC protocol sends them in plaintext over the network; and FIPS mode execution prohibits the use of a VNC password), so it is recommended that users not create domains with a VNC password in the first place. Domains that do not use VNC passwords do not suffer from information leaks; the use of SPICE connections is recommended not only because it avoids the leak, but also because SPICE provides better features than VNC for a guest graphics device. Furthermore, the leak is only possible when fine-grained ACLs are in use; read-only clients cannot trigger the issue. Therefore, the problem is avoided if no user is granted the 'read' ACL privilege without also having the 'read_secure' privilege. Another mitigation is that the information leak can only occur if a snapshot or save image exists; a user that is denied 'read_secure' is typically also unable to create such an image, so the leak depends on a more privileged user making use of that feature. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.1.0 Broken in: v1.1.1 Broken in: v1.1.2 Broken in: v1.1.3 Broken in: v1.1.4 Broken in: v1.2.0 Broken in: v1.2.1 Broken in: v1.2.2 Broken in: v1.2.3 Broken in: v1.2.4 Broken in: v1.2.5 Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Broken in: v1.2.11 Fixed in: v1.2.12 Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 03c3c0c874c84dfa51ef17556062b095c6e1c0a3 Fixed by: b1674ad5a97441b7e1bd5f5ebaff498ef2fbb11b Branch: v1.1.0-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: a976724f9a10730e1339628482a283653efdb72c Fixed by: c4c824ec818ce85de049ed5546fa8ce3c8b76e32 Branch: v1.1.1-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 9a2728e1b28b67a682e55d8dd3c0d79e21f0ad37 Fixed by: 2c6fc46d987911e310d30621cd6fc195af102fee Branch: v1.1.2-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 6eec2b830a752c95fc2d971d3daf7626f9701290 Fixed by: 947c969fc248c2324e565b5e4f80a3d11733f12b Branch: v1.1.3-maint Broken in: v1.1.3.1 Broken in: v1.1.3.2 Broken in: v1.1.3.3 Broken in: v1.1.3.4 Broken in: v1.1.3.5 Broken in: v1.1.3.6 Broken in: v1.1.3.7 Broken in: v1.1.3.8 Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: ca840e9c827fefadae2e00875b4a552b990b959f Fixed by: 76d6cc3f24ab545694e77e2eafa981d861b965a4 Branch: v1.1.4-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 43d16684c2018c20db1fba35542eb1d52ecb8d7a Fixed by: 17defce9159c5111e7011e575ba72803a9418086 Branch: v1.2.0-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 9475a25c86f3748e2069af67db69d79864b707b9 Fixed by: 8abca887b19600b6652654a01a78455afd4d8294 Branch: v1.2.1-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: f7c70c20530954c2c1a2ce0d192d01a8f71c0093 Fixed by: 1f348188e0698ef2535c81d5a779189531c5df99 Branch: v1.2.2-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: e99c25ca63c695a63b4c9b91ee956be4fb660772 Fixed by: 8107c1e3694ba4685960ec09868076379718f037 Branch: v1.2.3-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 4edae3cb9600132e875a5b97cf31089a6c8f4cb2 Fixed by: 94d18e8f6dbe3afdc72b6df13e3eaa8861874a14 Branch: v1.2.4-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: d406f0858e7e3a6199788d3c64217c69d7702032 Fixed by: 4700507a484aec43b02724893cbed931e52f86e0 Branch: v1.2.5-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: b0b5e885f05a80d63e8a457031ea884e867244ad Fixed by: 6b78ba5a15fb1077cee88cc30f1e5ba16485cd83 Branch: v1.2.6-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 9b056d8daf68b6357ca05adbfddb53a85d077a1d Fixed by: b87f3f835a5c88625d9514aae9a2ddf30bc64319 Branch: v1.2.7-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: cc0cc987a53f5e3825c7d972e219e08688d4480b Fixed by: aeb505814531d505f4d7718a10a96dd6dea14457 Branch: v1.2.8-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: c0f3e664a68509a3d842bdc3fd126257da46d0c0 Fixed by: cef411296b2513ffd80dbf9cab1f54bd0c68fe6a Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 19f8fec02d9b0a8de877d872c5b59597bd878a8d Fixed by: 295f3c88ce71b8e83a489cb0d48431e124c12081 Branch: v1.2.10-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: c379b17e259db4f07843c2a7a883fda1a1bd043f Fixed by: d6e10847e0cd2bd7fc1824ad65fe859987715881 Branch: v1.2.11-maint Broken by: e341435e5090677c67a0d3d4ca0393102054841f Fixed by: 41358b7e91a20c9a89b03202b8c4139f92dd1953 Fixed by: 7195a5fa4718d915b28bb6e3380255eb1fbf994a -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[Libvirt-announce] LSN-2014-0010: CVE-2014-8136 deadlock on failed migration
by Eric Blake 23 Dec '14

23 Dec '14

Libvirt Security Notice: LSN-2014-0008 ====================================== Summary: deadlock on failed migration Reported on: 20141208 Published on: 20141208 Fixed on: 20141209 Reported by: Peter Krempa <pkrempa(a)redhat.com> Patched by: Peter Krempa <pkrempa(a)redhat.com> See also: CVE-2014-8136 Description ----------- When using fine-grained ACLs to restrict users from migrating domains, a logic bug could leave the domain locked and prevent further operation on that domain. Impact ------ A client that lacks the domain:migrate fine-grained ACL could use a failed migration attempt to trigger a denial of service against a more privileged user. Workaround ---------- The bug is mitigated by the fact that the "perform" and "finish" states of migration can generally be reached only after a successful "begin" or "prepare" state, both of which also require the same domain:migrate permission. Furthermore, the "prepare" state also requires the domain:write permission, and any user which has been granted that permission is already deemed to have full control over the system; even if domain:migrate permission is dynamically denied after migration has already started in order to trigger the flaw, an attack by such a user generally does not constitute a denial of service against a more privileged user. On the other hand, a malicious client that has access to the read-write socket via only a weaker privilege such as domain:read can send RPC commands out of order, to attempt a "perform" without going through the prerequisite states, and thereby trigger the bug in a manner that forms a denial of service. Read-only clients cannot trigger the problem, even via bad RPC commands. It is possible to avoid the bug by not using the fine-grained access control mechanism. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.1.0 Broken in: v1.1.1 Broken in: v1.1.2 Broken in: v1.1.3 Broken in: v1.1.4 Broken in: v1.2.0 Broken in: v1.2.1 Broken in: v1.2.2 Broken in: v1.2.3 Broken in: v1.2.4 Broken in: v1.2.5 Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Fixed in: v1.2.11 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 2bdcd29c713dfedd813c89f56ae98f6f3898313d Branch: v1.1.0-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 540872ceae9d2850e42d3615f017feb46ab585aa Branch: v1.1.1-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: fb1e0312f4cfc2375ee94d40e5f2999cd761337d Branch: v1.1.2-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 12c35ca8e6a1dff79fe706b24edc094be7df9f93 Branch: v1.1.3-maint Broken in: v1.1.3.1 Broken in: v1.1.3.2 Broken in: v1.1.3.3 Broken in: v1.1.3.4 Broken in: v1.1.3.5 Broken in: v1.1.3.6 Broken in: v1.1.3.7 Broken in: v1.1.3.8 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 63934cae465f757c774db1fa4e86d3c8bda4591b Branch: v1.1.4-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 995516ad3dc64fb5a5102ad0fbbea6e1701f0d8d Branch: v1.2.0-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 0d365c6f707f55e77ff14d6a52a59b7d1c43f8a4 Branch: v1.2.1-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 75dfd58284de1fdc146b8aa3deb7d6a2057f0391 Branch: v1.2.2-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: f5a151754f2080598049baf5d68282f183a30f5c Branch: v1.2.3-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: e0e2f7eafc5adfbac4343592def097cbe8a67653 Branch: v1.2.4-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 4ba560e050fa83a2ef2083fbfa0ad9484b9393d4 Branch: v1.2.5-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: cd3d695a6be8398b399d0d06c26a618b12ad8946 Branch: v1.2.6-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: bad50b7501ebfe8076a6f7809d7b44b7a94c38ef Branch: v1.2.7-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 220759259bcbcc705a96dc1cbaeb2f2ce980c479 Branch: v1.2.8-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 372bfe63b501c7580400107682633ad421416f88 Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 12496319a24dd923c5f321c84112fd0e73979413 Branch: v1.2.10-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 2a121c635306cd498cdabb63a806ae17821b245f -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0