diff --git a/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch b/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch new file mode 100644 index 0000000..d954f76 --- /dev/null +++ b/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch @@ -0,0 +1,68 @@ +From 5a1b3e1c63239d346d481c27f3624f66397a0a0b Mon Sep 17 00:00:00 2001 +Message-ID: <5a1b3e1c63239d346d481c27f3624f66397a0a0b.1787836581.git.jdenemar@redhat.com> +From: Peter Krempa +Date: Wed, 12 Aug 2026 16:51:58 +0200 +Subject: [PATCH] remote: Fix integer overflow in RPC handler for + virNodeGetFreePages (CVE-2026-18917) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE-2026-18917 + +The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages' +argument with the 'cellcount' argument passed to 'virNodeGetFreePages', +both of which are declared as 'unsigned int' to both do an RPC limit +check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate +the memory to hold the result from the actual hypervisor driver. + +Since both the values are 'unsigned int' the product is also unsigned +int so big enough numbers can overflow, both passing the check and also +allocating not enough memory for the result. The hypervisor driver +assumes that the passed buffer is large enough and overwrites memory. + +When this happens the the hypervisor daemon crashes. + +This can be triggered e.g. by passing 1023 and 4198405 as values which +multiply to 1019 after wrapping to 32 bit unsigned value. + +Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue +the same way as we do for other APIs doing multiplication of arguments +to determine amount of required memory. + +Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d) +Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903 +Signed-off-by: Peter Krempa +Reviewed-by: Daniel P. Berrangé +(cherry picked from commit 5a62cbf2907d4590283597b46da9c0f41e7b4d4f) + +https://redhat.atlassian.net/browse/RHEL-245273 +--- + src/remote/remote_daemon_dispatch.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c +index 329853b6da..7e2b76a7ce 100644 +--- a/src/remote/remote_daemon_dispatch.c ++++ b/src/remote/remote_daemon_dispatch.c +@@ -6723,13 +6723,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + +- if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { +- virReportError(VIR_ERR_INTERNAL_ERROR, "%s", +- _("the result won't fit into REMOTE_NODE_MAX_CELLS")); ++ if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) || ++ args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, ++ _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"), ++ REMOTE_NODE_MAX_CELLS); + goto cleanup; + } + +- /* Allocate return buffer. */ + ret->counts.counts_val = g_new0(uint64_t, + args->pages.pages_len * args->cellCount); + +-- +2.55.0 diff --git a/libvirt.spec b/libvirt.spec index 1036505..cc92892 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -298,7 +298,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 12.5.0 -Release: 3%{?dist}%{?extra_release}.alma.1 +Release: 4%{?dist}%{?extra_release}.alma.1 License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1 URL: https://libvirt.org/ @@ -336,6 +336,7 @@ Patch27: libvirt-qemu_agent-Introduce-guest-get-devices.patch Patch28: libvirt-qemuagenttest-Introduce-GetGuestDeviceInfo-test-case.patch Patch29: libvirt-qemu-Implement-device-info-for-virDomainGetGuestInfo-API.patch Patch30: libvirt-virsh-Add-support-for-VIR_DOMAIN_GUEST_INFO_DEVICES.patch +Patch31: libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch Requires: libvirt-daemon = %{version}-%{release} @@ -2738,9 +2739,12 @@ exit 0 %endif %changelog -* Fri Aug 21 2026 Eduard Abdullin - 12.5.0-3.alma.1 +* Sat Aug 29 2026 Eduard Abdullin - 12.5.0-4.alma.1 - Enable building for ppc64le +* Thu Aug 27 2026 Jiri Denemark - 12.5.0-4 +- remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (CVE-2026-18917, RHEL-245273) + * Wed Aug 19 2026 Jiri Denemark - 12.5.0-3 - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242545) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242545)