[libvirt] CVE-2013-4153, CVE-2013-4154

Two CVEs have been assigned for recent patches both related to 'virsh vcpucount'. I have backported these patches to v1.1.0-maint (the only release impacted by either bug). CVE-2013-4153 was introduced by commit v1.0.6-48-gc6afcb0, and could allow a read-only client to cause a double free in libvirtd on a domain that has an active guest agent. CVE-2013-4154 was introduced by commit v1.0.6-47-g29c1e91, and could allow a read-only client to cause libvirtd to crash on a domain without a guest agent. commit dfc692350a04a70b4ca65667c30869b3bfdaf034 Author: Peter Krempa <pkrempa(a)redhat.com&gt; Date: Tue Jul 16 15:39:06 2013 +0200 qemu: Fix double free of returned JSON array in qemuAgentGetVCPUs() A part of the returned monitor response was freed twice and caused crashes of the daemon when using guest agent cpu count retrieval. # virsh vcpucount dom --guest Introduced in v1.0.6-48-gc6afcb0 commit 96518d4316b711c72205117f8d5c967d5127bbb6 Author: Alex Jia <ajia(a)redhat.com&gt; Date: Tue Jul 16 17:30:20 2013 +0800 qemu: Prevent crash of libvirtd without guest agent configuration If users haven't configured guest agent then qemuAgentCommand() will dereference a NULL 'mon' pointer, which causes crash of libvirtd when using agent based cpu (un)plug. With the patch, when the qemu-ga service isn't running in the guest, a expected error "error: Guest agent is not responding: Guest agent not available for now" will be raised, and the error "error: argument unsupported: QEMU guest agent is not configured" is raised when the guest hasn't configured guest agent. GDB backtrace: (gdb) bt #0 virNetServerFatalSignal (sig=11, siginfo=<value optimized out>, context=<value optimized out>) at rpc/virnetserver.c:326 #1 <signal handler called> #2 qemuAgentCommand (mon=0x0, cmd=0x7f39300017b0, reply=0x7f394b090910, seconds=-2) at qemu/qemu_agent.c:975 #3 0x00007f39429507f6 in qemuAgentGetVCPUs (mon=0x0, info=0x7f394b0909b8) at qemu/qemu_agent.c:1475 #4 0x00007f39429d9857 in qemuDomainGetVcpusFlags (dom=<value optimized out>, flags=9) at qemu/qemu_driver.c:4849 #5 0x00007f3957dffd8d in virDomainGetVcpusFlags (domain=0x7f39300009c0, flags=8) at libvirt.c:9843 How to reproduce? # To start a guest without guest agent configuration # then run the following cmdline # virsh vcpucount foobar --guest error: End of file while reading data: Input/output error error: One or more references were leaked after disconnect from the hypervisor error: Failed to reconnect to the hypervisor RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=984821 Signed-off-by: Alex Jia <ajia(a)redhat.com&gt; Signed-off-by: Peter Krempa <pkrempa(a)redhat.com&gt; -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org