File ae076bb4-remote-CVE-2019-3886.patch of Package libvirt

Overview Repositories Revisions Requests Users Attributes Meta

File ae076bb4-remote-CVE-2019-3886.patch of Package libvirt (Revision 6935b18ddd22b5aaa7b52d42b67e426d)

Currently displaying revision 6935b18ddd22b5aaa7b52d42b67e426d , Show latest

commit ae076bb40e0e150aef41361b64001138d04d6c60
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Wed Mar 27 11:22:49 2019 +0000

remote: enforce ACL write permission for getting guest time & hostname
    
    Getting the guest time and hostname both require use of guest agent
    commands. These must not be allowed for read-only users, so the
    permissions check must validate "write" permission not "read".
    
    Fixes CVE-2019-3886
    Reviewed-by: Jim Fehlig <jfehlig@suse.com>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Index: libvirt-5.2.0/src/remote/remote_protocol.x
===================================================================
--- libvirt-5.2.0.orig/src/remote/remote_protocol.x
+++ libvirt-5.2.0/src/remote/remote_protocol.x
@@ -5513,7 +5513,7 @@ enum remote_procedure {
 
     /**
      * @generate: both
-     * @acl: domain:read
+     * @acl: domain:write
      */
     REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277,
 
@@ -5908,7 +5908,7 @@ enum remote_procedure {
 
     /**
      * @generate: none
-     * @acl: domain:read
+     * @acl: domain:write
      */
     REMOTE_PROC_DOMAIN_GET_TIME = 337,

Places

File ae076bb4-remote-CVE-2019-3886.patch of Package libvirt (Revision 6935b18ddd22b5aaa7b52d42b67e426d)

Places