From cfd51dd25fd8d741c6f4c3f5e489e0cc392571e6 Mon Sep 17 00:00:00 2001 From: Jiri Denemark Date: Fri, 21 Aug 2026 16:14:54 +0200 Subject: [PATCH] libvirt-8.0.0-23.7.el8 - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245267) Resolves: RHEL-245267 --- ...r-virNodeGetFreePages-CVE-2026-18917.patch | 68 +++++++++++++++++++ libvirt.spec | 6 +- 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch diff --git a/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch b/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch new file mode 100644 index 0000000..68bf7a4 --- /dev/null +++ b/libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch @@ -0,0 +1,68 @@ +From 35af501532694a948973af7329c3b96798da1c33 Mon Sep 17 00:00:00 2001 +Message-ID: <35af501532694a948973af7329c3b96798da1c33.1787321694.git.jdenemar@redhat.com> +From: Peter Krempa +Date: Wed, 12 Aug 2026 16:51:58 +0200 +Subject: [PATCH] remote: Fix integer overflow in RPC handler for + virNodeGetFreePages (CVE-2026-18917) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE-2026-18917 + +The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages' +argument with the 'cellcount' argument passed to 'virNodeGetFreePages', +both of which are declared as 'unsigned int' to both do an RPC limit +check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate +the memory to hold the result from the actual hypervisor driver. + +Since both the values are 'unsigned int' the product is also unsigned +int so big enough numbers can overflow, both passing the check and also +allocating not enough memory for the result. The hypervisor driver +assumes that the passed buffer is large enough and overwrites memory. + +When this happens the the hypervisor daemon crashes. + +This can be triggered e.g. by passing 1023 and 4198405 as values which +multiply to 1019 after wrapping to 32 bit unsigned value. + +Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue +the same way as we do for other APIs doing multiplication of arguments +to determine amount of required memory. + +Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d) +Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903 +Signed-off-by: Peter Krempa +Reviewed-by: Daniel P. Berrangé +(cherry picked from commit 5a62cbf2907d4590283597b46da9c0f41e7b4d4f) + +https://redhat.atlassian.net/browse/RHEL-245267 +--- + src/remote/remote_daemon_dispatch.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c +index c193227926..f8b644b1e9 100644 +--- a/src/remote/remote_daemon_dispatch.c ++++ b/src/remote/remote_daemon_dispatch.c +@@ -6658,13 +6658,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED, + if (!conn) + goto cleanup; + +- if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { +- virReportError(VIR_ERR_INTERNAL_ERROR, "%s", +- _("the result won't fit into REMOTE_NODE_MAX_CELLS")); ++ if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) || ++ args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, ++ _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"), ++ REMOTE_NODE_MAX_CELLS); + goto cleanup; + } + +- /* Allocate return buffer. */ + ret->counts.counts_val = g_new0(uint64_t, + args->pages.pages_len * args->cellCount); + +-- +2.55.0 diff --git a/libvirt.spec b/libvirt.spec index 59889fd..a5fa0f4 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -210,7 +210,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 8.0.0 -Release: 23.6%{?dist}%{?extra_release} +Release: 23.7%{?dist}%{?extra_release} License: LGPLv2+ URL: https://libvirt.org/ @@ -335,6 +335,7 @@ Patch112: libvirt-virsh-Add-option-no-pkttyagent.patch Patch113: libvirt-services-Weaken-systemd-dependency-on-virtlockd.patch Patch114: libvirt-qemu-Ensure-proper-shutdown-ordering-of-virtlockd-virtlogd-daemons.patch Patch115: libvirt-qemu-Fix-proper-ordering-of-virtlockd-shutdown.patch +Patch116: libvirt-remote-Fix-integer-overflow-in-RPC-handler-for-virNodeGetFreePages-CVE-2026-18917.patch Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-daemon-config-network = %{version}-%{release} @@ -2214,6 +2215,9 @@ exit 0 %changelog +* Fri Aug 21 2026 Jiri Denemark - 8.0.0-23.7.el8 +- remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245267) + * Wed Aug 19 2026 Jiri Denemark - 8.0.0-23.6.el8 - services: Weaken systemd dependency on virtlockd (RHEL-224988) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224988)