libvirt: Security fix for CVE-2020-10701

Source:  https://libvirt.org/git/libvirt.git
MR: 110898
Type: Security Fix
Disposition: Backport from https://libvirt.org/git/?p=libvirt.git;a=commit;h=4cc90c2e62df653e909ad31fd810224bf8bcf913
ChangeID: 73bff4861d76b0674547ead4d4b251b60705bb8c
Description:

Affect libvirt < 6.2.0

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

2 files changed, 40 insertions, 0 deletions

diff --git a/recipes-extended/libvirt/libvirt/CVE-2020-10701.patch b/recipes-extended/libvirt/libvirt/CVE-2020-10701.patch
new file mode 100644
index 00000000..453b02ba
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2020-10701.patch
@@ -0,0 +1,39 @@
+From 4cc90c2e62df653e909ad31fd810224bf8bcf913 Mon Sep 17 00:00:00 2001
+From: Jonathon Jongsma <jjongsma@redhat.com>
+Date: Fri, 20 Mar 2020 09:43:13 -0500
+Subject: [PATCH] api: disallow virDomainAgentSetResponseTimeout() on read-only
+ connections
+
+This function changes the amount of time that libvirt waits for a
+response from the guest agent for all guest agent commands. Since this
+is a configuration change, it should not be allowed on read-only
+connections.
+
+Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
+Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+
+Upstream-Status: Backport
+CVE: CVE-2020-10701 
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ src/libvirt-domain.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
+index 65813b68cc..a12809c2d5 100644
+--- a/src/libvirt-domain.c
++++ b/src/libvirt-domain.c
+@@ -12576,6 +12576,8 @@ virDomainAgentSetResponseTimeout(virDomainPtr domain,
+     virCheckDomainReturn(domain, -1);
+     conn = domain->conn;
+ 
++    virCheckReadOnlyGoto(conn->flags, error);
++
+     if (conn->driver->domainAgentSetResponseTimeout) {
+         if (conn->driver->domainAgentSetResponseTimeout(domain, timeout, flags) < 0)
+             goto error;
+-- 
+2.25.1
+
diff --git a/recipes-extended/libvirt/libvirt_6.1.0.bb b/recipes-extended/libvirt/libvirt_6.1.0.bb
index f301a0e3..0146c6cb 100644
--- a/recipes-extended/libvirt/libvirt_6.1.0.bb
+++ b/recipes-extended/libvirt/libvirt_6.1.0.bb
@@ -40,6 +40,7 @@ SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
            file://0001-build-drop-unnecessary-libgnu.la-reference.patch \
            file://hook_support.py \
            file://gnutls-helper.py \
+           file://CVE-2020-10701.patch \
           "
 
 SRC_URI[libvirt.md5sum] = "a870e63f20fac2ccf98e716d05256145"