Date: Tue, 14 Jan 2014 11:25:07 -0500 (EST) From: cve-assign@...re.org To: pmatouse@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, libvirt-security@...hat.com, jdenemar@...hat.com, eblake@...hat.com Subject: Re: CVE Request -- libvirt: denial of service with keepalive -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://bugzilla.redhat.com/show_bug.cgi?id=1047577 > This is now fixed upstream by v1.2.1-rc1-33-g173c291: > To avoid the crash, virNetServerClientStartKeepAlive needs to check if > the connection is still open before starting keep-alive protocol. Use CVE-2014-1447 for this issue in which the product does not check whether the connection is still open. This corresponds to 173c2914734eb5c32df6d35a82bf503e12261bcf, which apparently would be of some value in some attack scenarios. > And really fixed by v1.2.1-rc1-37-g066c8ef: > it is possible to hit a window when client->keepalive is NULL while > client->sock is not NULL. I was thinking client->sock == NULL was a > better check for a closed connection but apparently we have to go with > client->keepalive == NULL to actually fix the crash. Use CVE-2014-1448 for this issue in which the product does not properly check whether the connection is still open. This corresponds to 066c8ef6c18bc1faf8b3e10787b39796a7a06cc0, which apparently is of value in additional attack scenarios. In deciding to SPLIT, all of these factors were considered but we don't want to try to precisely specify whether any one factor would be sufficient on its own: 1. There seem to be two distinct version-like identifiers, v1.2.1-rc1-33-g173c291 and v1.2.1-rc1-37-g066c8ef, which can be interpreted as different affected versions. 2. The first patch alone was accepted in the https://www.redhat.com/archives/libvir-list/2014-January/msg00532.html and https://www.redhat.com/archives/libvir-list/2014-January/msg00554.html messages. 3. http://libvirt.org/downloads.html says "Once an hour, an automated snapshot is made from the git server source tree. These snapshots should be usable." This suggests that a "version" with only the first patch was, in some realistic sense, "packaged for distribution," and could conceivably be in use somewhere. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS1WRSAAoJEKllVAevmvmsIt8H/jCNn0XONft+Gt8BJcj/GdnU UF/3f0Q9w3yvn94o39BYmHGpd1ComLzdWHDCEIg0b8J88jvSRCZCqLjgQQvWKKWZ CEnTnnaeJhmYLGTNFKmbA/4eBLAr8fTbUJUjfZMxZoCOA5pfYY1pWne6ofU0nC7w 5A89qUre9HKCsjCL7TzPgQOsp38TJG+dHdkhWEmmMRA499If9QHjv5Qkb429QGqS rcMb72E4TVG4l9ItNyhu4E3GB/k3UDpLLBbGyfdysQLml0Ut+0Dnp2hOdpcOBSTr tY8i8kQhNuGKyfeP6gzWHUeh2SRSJRcDzGzjVMVf/in1EUWvUaMgYwqz9tfpLOg= =9kpY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ