File 034e47c3-CVE-2015-5313.patch of Package libvirt

Overview Repositories Revisions Requests Users Attributes Meta

File 034e47c3-CVE-2015-5313.patch of Package libvirt (Revision 1d17719965abf3cea1ad8f2be62dd898)

Currently displaying revision 1d17719965abf3cea1ad8f2be62dd898 , Show latest

commit 034e47c338b13a95cf02106a3af912c1c5f818d7
Author: Eric Blake <eblake@redhat.com>
Date:   Tue Dec 8 17:46:31 2015 -0700

CVE-2015-5313: storage: don't allow '/' in filesystem volume names
    
    The libvirt file system storage driver determines what file to
    act on by concatenating the pool location with the volume name.
    If a user is able to pick names like "../../../etc/passwd", then
    they can escape the bounds of the pool.  For that matter,
    virStoragePoolListVolumes() doesn't descend into subdirectories,
    so a user really shouldn't use a name with a slash.
    
    Normally, only privileged users can coerce libvirt into creating
    or opening existing files using the virStorageVol APIs; and such
    users already have full privilege to create any domain XML (so it
    is not an escalation of privilege).  But in the case of
    fine-grained ACLs, it is feasible that a user can be granted
    storage_vol:create but not domain:write, and it violates
    assumptions if such a user can abuse libvirt to access files
    outside of the storage pool.
    
    Therefore, prevent all use of volume names that contain "/",
    whether or not such a name is actually attempting to escape the
    pool.
    
    This changes things from:
    
    $ virsh vol-create-as default ../../../../../../etc/haha --capacity 128
    Vol ../../../../../../etc/haha created
    $ rm /etc/haha
    
    to:
    
    $ virsh vol-create-as default ../../../../../../etc/haha --capacity 128
    error: Failed to create vol ../../../../../../etc/haha
    error: Requested operation is not valid: volume name '../../../../../../etc/haha' cannot contain '/'
    
    Signed-off-by: Eric Blake <eblake@redhat.com>

Index: libvirt-1.3.0/src/storage/storage_backend_fs.c
===================================================================
--- libvirt-1.3.0.orig/src/storage/storage_backend_fs.c
+++ libvirt-1.3.0/src/storage/storage_backend_fs.c
@@ -1,7 +1,7 @@
 /*
  * storage_backend_fs.c: storage backend for FS and directory handling
  *
- * Copyright (C) 2007-2014 Red Hat, Inc.
+ * Copyright (C) 2007-2015 Red Hat, Inc.
  * Copyright (C) 2007-2008 Daniel P. Berrange
  *
  * This library is free software; you can redistribute it and/or
@@ -1057,6 +1057,14 @@ virStorageBackendFileSystemVolCreate(vir
     else
         vol->type = VIR_STORAGE_VOL_FILE;
 
+    /* Volumes within a directory pools are not recursive; do not
+     * allow escape to ../ or a subdir */
+    if (strchr(vol->name, '/')) {
+        virReportError(VIR_ERR_OPERATION_INVALID,
+                       _("volume name '%s' cannot contain '/'"), vol->name);
+        return -1;
+    }
+
     VIR_FREE(vol->target.path);
     if (virAsprintf(&vol->target.path, "%s/%s",
                     pool->def->target.path,

Places

File 034e47c3-CVE-2015-5313.patch of Package libvirt (Revision 1d17719965abf3cea1ad8f2be62dd898)

Places