Date: Wed, 8 Dec 2010 09:23:58 -0700 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Cc: Eric Blake <eblake@...hat.com>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request: libvirt when compiled with openvz support has a potential security hole * [2010-12-08 09:07:30 +0800] Eugene Teo wrote: >On 12/08/2010 08:21 AM, Vincent Danen wrote: >>We were notified of a fix to upstream libvirt that plugs a potential >>security hole (buffer overflow) via the OpenVZ support in libvirt. >> >>Red Hat and Fedora do not ship libvirt with OpenVZ support enabled; I'm >>not sure if other vendors do or not. >> >>The patch was posted publicly today, and although it's a low impact >>issue, probably needs a CVE name. >> >>https://www.redhat.com/archives/libvir-list/2010-December/msg00348.html > >CC'ed Steve. Thanks Eugene. After some further looking at this, I'd like to retract the request for a CVE name as premature. This is not a security issue because the output strings from vzlist are fixed. So it would need to be compromised in some way (fake binary, etc.) before it could cause any problems for libvirt, at which point you have a bigger problem on your hands. Since libvirt is calling vzlist with hard-coded parameters as well, it is not feasible to have "garbage" returned that could cause this overflow in libvirt. Sorry for the noise; please don't assign a CVE name to this issue (bug). Thanks! -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.