Commit a4947e8f authored by Daniel P. Berrangé's avatar Daniel P. Berrangé 💬
Browse files

nwfilter: fix crash when counting number of network filters



The virNWFilterObjListNumOfNWFilters method iterates over the
driver->nwfilters, accessing virNWFilterObj instances. As such
it needs to be protected against concurrent modification of
the driver->nwfilters object.

This API allows unprivileged users to connect, so users with
read-only access to libvirt can cause a denial of service
crash if they are able to race with a call of virNWFilterUndefine.
Since network filters are usually statically defined, this is
considered a low severity problem.

This is assigned CVE-2022-0897.

Reviewed-by: Eric Blake's avatarEric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé's avatarDaniel P. Berrangé <berrange@redhat.com>
parent 92e00c7a
......@@ -478,11 +478,15 @@ nwfilterLookupByName(virConnectPtr conn,
static int
nwfilterConnectNumOfNWFilters(virConnectPtr conn)
{
int ret;
if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
return -1;
return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
virConnectNumOfNWFiltersCheckACL);
nwfilterDriverLock();
ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
virConnectNumOfNWFiltersCheckACL);
nwfilterDriverUnlock();
return ret;
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment