mirrors/libguestfs
1
0
Fork 0
mirror of https://github.com/libguestfs/libguestfs.git synced 2026-03-21 22:53:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs/guestfs-security: document CVE-2022-2211

Browse Source 
Short log for the common submodule, commit range
f8de5508fe75..35467027f657:

Laszlo Ersek (2):
      mlcustomize: factor out pkg install/update/uninstall from guestfs-tools
      options: fix buffer overflow in get_keys() [CVE-2022-2211]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2100862
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-Id: <20220628115418.5376-2-lersek@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
This commit is contained in:
Laszlo Ersek
2022-06-28 13:54:16 +02:00
parent 4159f72bb7
commit 99844660b4
2 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common

Submodule common updated: f8de5508fe...35467027f6

28
docs/guestfs-security.pod
View File

@@ -406,6 +406,34 @@ The libvirt backend is not affected.
The solution is to update qemu to a version containing the fix (see
L<https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html>).
=head2 CVE-2022-2211
L<https://bugzilla.redhat.com/CVE-2022-2211>
The C<get_keys> function in F<libguestfs-common/options/keys.c> collects
those I<--key> options from the command line into a new array that match
a particular block device that's being decrypted for inspection. The
function intends to size the result array such that potentially all
I<--key> options, plus a terminating C<NULL> element, fit into it. The
code mistakenly uses the C<MIN> macro instead of C<MAX>, and therefore
only one element is allocated before the C<NULL> terminator.
Passing precisely two I<--key ID:...> options on the command line for
the encrypted block device C<ID> causes C<get_keys> to overwrite the
terminating C<NULL>, leading to an out-of-bounds read in
C<decrypt_mountables>, file F<libguestfs-common/options/decrypt.c>.
Passing more than two I<--key ID:...> options on the command line for
the encrypted block device C<ID> causes C<get_keys> itself to perform
out-of-bounds writes. The most common symptom is a crash with C<SIGSEGV>
later on.
This issue affects -- broadly speaking -- all libguestfs-based utilities
that accept I<--key>, namely: C<guestfish>, C<guestmount>, C<virt-cat>,
C<virt-customize>, C<virt-diff>, C<virt-edit>, C<virt-get-kernel>,
C<virt-inspector>, C<virt-log>, C<virt-ls>, C<virt-sparsify>,
C<virt-sysprep>, C<virt-tail>, C<virt-v2v>.
=head1 SEE ALSO
L<guestfs(3)>,