libvirt-8.0.0-23.7.el8

- remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245267)

Resolves: RHEL-245267

libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch

@@ -0,0 +1,68 @@
+From 35af501532694a948973af7329c3b96798da1c33 Mon Sep 17 00:00:00 2001
+Message-ID: <35af501532694a948973af7329c3b96798da1c33.1787321694.git.jdenemar@redhat.com>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 12 Aug 2026 16:51:58 +0200
+Subject: [PATCH] remote: Fix integer overflow in RPC handler for
+ virNodeGetFreePages (CVE-2026-18917)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2026-18917
+
+The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'
+argument with the 'cellcount' argument passed to 'virNodeGetFreePages',
+both of which are declared as 'unsigned int' to both do an RPC limit
+check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate
+the memory to hold the result from the actual hypervisor driver.
+
+Since both the values are 'unsigned int' the product is also unsigned
+int so big enough numbers can overflow, both passing the check and also
+allocating not enough memory for the result. The hypervisor driver
+assumes that the passed buffer is large enough and overwrites memory.
+
+When this happens the the hypervisor daemon crashes.
+
+This can be triggered e.g. by passing 1023 and 4198405 as values which
+multiply to 1019 after wrapping to 32 bit unsigned value.
+
+Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue
+the same way as we do for other APIs doing multiplication of arguments
+to determine amount of required memory.
+
+Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d)
+Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 5a62cbf2907d4590283597b46da9c0f41e7b4d4f)
+
+https://redhat.atlassian.net/browse/RHEL-245267
+---
+ src/remote/remote_daemon_dispatch.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index c193227926..f8b644b1e9 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -6658,13 +6658,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED,
+     if (!conn)
+         goto cleanup;
+ 
+-    if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
+-        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+-                       _("the result won't fit into REMOTE_NODE_MAX_CELLS"));
++    if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) ||
++        args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
++        virReportError(VIR_ERR_INTERNAL_ERROR,
++                       _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"),
++                       REMOTE_NODE_MAX_CELLS);
+         goto cleanup;
+     }
+ 
+-    /* Allocate return buffer. */
+     ret->counts.counts_val = g_new0(uint64_t,
+                                     args->pages.pages_len * args->cellCount);
+ 
+-- 
+2.55.0

libvirt.spec

@@ -210,7 +210,7 @@
 Summary: Library providing a simple virtualization API
 Name: libvirt
 Version: 8.0.0
-Release: 23.6%{?dist}%{?extra_release}
+Release: 23.7%{?dist}%{?extra_release}
 License: LGPLv2+
 URL: https://libvirt.org/
 
@@ -335,6 +335,7 @@ Patch112: libvirt-virsh-Add-option-no-pkttyagent.patch
 Patch113: libvirt-services-Weaken-systemd-dependency-on-virtlockd.patch
 Patch114: libvirt-qemu-Ensure-proper-shutdown-ordering-of-virtlockd-virtlogd-daemons.patch
 Patch115: libvirt-qemu-Fix-proper-ordering-of-virtlockd-shutdown.patch
+Patch116: libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -2214,6 +2215,9 @@ exit 0
 
 
 %changelog
+* Fri Aug 21 2026 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.7.el8
+- remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245267)
+
 * Wed Aug 19 2026 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.6.el8
 - services: Weaken systemd dependency on virtlockd (RHEL-224988)
 - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224988)