From 9e9868ef3d6e5da7f0ecd0680fcd69324593842b Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Thu, 16 Sep 2021 14:23:05 -0700 Subject: libvirt: Security fix for CVE-2021-3631 Source: https://libvirt.org/git/libvirt.git MR: 112956 Type: Security Fix Disposition: Backport from https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2 ChangeID: 314727e329e5b1351326737eb9c9232f465db184 Description: Signed-off-by: Armin Kuster Signed-off-by: Bruce Ashfield --- .../libvirt/libvirt/CVE-2021-3631.patch | 56 ++++++++++++++++++++++ recipes-extended/libvirt/libvirt_6.1.0.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 recipes-extended/libvirt/libvirt/CVE-2021-3631.patch (limited to 'recipes-extended/libvirt') diff --git a/recipes-extended/libvirt/libvirt/CVE-2021-3631.patch b/recipes-extended/libvirt/libvirt/CVE-2021-3631.patch new file mode 100644 index 00000000..c1fa8c2f --- /dev/null +++ b/recipes-extended/libvirt/libvirt/CVE-2021-3631.patch @@ -0,0 +1,56 @@ +From 15073504dbb624d3f6c911e85557019d3620fdb2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 28 Jun 2021 13:09:04 +0100 +Subject: [PATCH] security: fix SELinux label generation logic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A process can access a file if the set of MCS categories +for the file is equal-to *or* a subset-of, the set of +MCS categories for the process. + +If there are two VMs: + + a) svirt_t:s0:c117 + b) svirt_t:s0:c117,c720 + +Then VM (b) is able to access files labelled for VM (a). + +IOW, we must discard case where the categories are equal +because that is a subset of many other valid category pairs. + +Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153 +CVE-2021-3631 +Reviewed-by: Peter Krempa +Signed-off-by: Daniel P. Berrangé + +Upstream-Status: Backport +CVE: CVE-2021-3631 +Signed-off-by: Armin Kuster + +--- + src/security/security_selinux.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +Index: libvirt-6.1.0/src/security/security_selinux.c +=================================================================== +--- libvirt-6.1.0.orig/src/security/security_selinux.c ++++ libvirt-6.1.0/src/security/security_selinux.c +@@ -391,7 +391,15 @@ virSecuritySELinuxMCSFind(virSecurityMan + VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin); + + if (c1 == c2) { +- mcs = g_strdup_printf("%s:c%d", sens, catMin + c1); ++ /* ++ * A process can access a file if the set of MCS categories ++ * for the file is equal-to *or* a subset-of, the set of ++ * MCS categories for the process. ++ * ++ * IOW, we must discard case where the categories are equal ++ * because that is a subset of other category pairs. ++ */ ++ continue; + } else { + if (c1 > c2) { + int t = c1; diff --git a/recipes-extended/libvirt/libvirt_6.1.0.bb b/recipes-extended/libvirt/libvirt_6.1.0.bb index aa7563f6..d4978b38 100644 --- a/recipes-extended/libvirt/libvirt_6.1.0.bb +++ b/recipes-extended/libvirt/libvirt_6.1.0.bb @@ -45,6 +45,7 @@ SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \ file://CVE-2020-25637_2.patch \ file://CVE-2020-25637_3.patch \ file://CVE-2020-25637_4.patch \ + file://CVE-2021-3631.patch \ " SRC_URI[libvirt.md5sum] = "a870e63f20fac2ccf98e716d05256145" -- cgit v1.2.3-54-g00ecf