oss-security - Re: CVE request: libvirt when compiled with openvz support has a potential security hole

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 8 Dec 2010 09:23:58 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Eric Blake <eblake@...hat.com>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: libvirt when compiled with openvz
 support has a potential security hole

* [2010-12-08 09:07:30 +0800] Eugene Teo wrote:

>On 12/08/2010 08:21 AM, Vincent Danen wrote:
>>We were notified of a fix to upstream libvirt that plugs a potential
>>security hole (buffer overflow) via the OpenVZ support in libvirt.
>>
>>Red Hat and Fedora do not ship libvirt with OpenVZ support enabled; I'm
>>not sure if other vendors do or not.
>>
>>The patch was posted publicly today, and although it's a low impact
>>issue, probably needs a CVE name.
>>
>>https://www.redhat.com/archives/libvir-list/2010-December/msg00348.html
>
>CC'ed Steve.

Thanks Eugene.

After some further looking at this, I'd like to retract the request for
a CVE name as premature.  This is not a security issue because the
output strings from vzlist are fixed.  So it would need to be
compromised in some way (fake binary, etc.) before it could cause any
problems for libvirt, at which point you have a bigger problem on your
hands.

Since libvirt is calling vzlist with hard-coded parameters as well, it
is not feasible to have "garbage" returned that could cause this
overflow in libvirt.

Sorry for the noise; please don't assign a CVE name to this issue (bug).

Thanks!

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.