Re: CVE request: libvirt when compiled with openvz support has a potential security hole

[Vincent Danen <vdanen () redhat com>]

* [2010-12-08 09:07:30 +0800] Eugene Teo wrote:

> On 12/08/2010 08:21 AM, Vincent Danen wrote:
> > We were notified of a fix to upstream libvirt that plugs a potential
> > security hole (buffer overflow) via the OpenVZ support in libvirt.
> >
> > Red Hat and Fedora do not ship libvirt with OpenVZ support enabled; I'm
> > not sure if other vendors do or not.
> >
> > The patch was posted publicly today, and although it's a low impact
> > issue, probably needs a CVE name.
> >
> > https://www.redhat.com/archives/libvir-list/2010-December/msg00348.html
>
> CC'ed Steve.

Thanks Eugene.

After some further looking at this, I'd like to retract the request for
a CVE name as premature.  This is not a security issue because the
output strings from vzlist are fixed.  So it would need to be
compromised in some way (fake binary, etc.) before it could cause any
problems for libvirt, at which point you have a bigger problem on your
hands.

Since libvirt is calling vzlist with hard-coded parameters as well, it
is not feasible to have "garbage" returned that could cause this
overflow in libvirt.

Sorry for the noise; please don't assign a CVE name to this issue (bug).

Thanks!

--
Vincent Danen / Red Hat Security Response Team