libvirt: CVE-2024-4418: stack use-after-free in virNetClientIOEventLoop()

Debian Bug report logs - #1070330
libvirt: CVE-2024-4418: stack use-after-free in virNetClientIOEventLoop()

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libvirt: CVE-2024-4418: stack use-after-free in virNetClientIOEventLoop()

Date: Fri, 03 May 2024 21:10:23 +0200

Source: libvirt
Version: 10.2.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for libvirt.

CVE-2024-4418[0]:
| stack use-after-free in virNetClientIOEventLoop()


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-4418
    https://www.cve.org/CVERecord?id=CVE-2024-4418
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2278616
[2] https://gitlab.com/libvirt/libvirt/-/commit/8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1070330@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1070330@bugs.debian.org

Subject: Re: [Pkg-libvirt-maintainers] Bug#1070330: libvirt: CVE-2024-4418: stack use-after-free in virNetClientIOEventLoop()

Date: Fri, 3 May 2024 21:47:30 +0200

control: -1 +pending

Hi,
On Fri, May 03, 2024 at 09:10:23PM +0200, Salvatore Bonaccorso wrote:
> Source: libvirt
> Version: 10.2.0-1
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> 
> Hi,
> 
> The following vulnerability was published for libvirt.
> 
> CVE-2024-4418[0]:
> | stack use-after-free in virNetClientIOEventLoop()
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

See https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/220

Cheers,
 -- Guido

> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2024-4418
>     https://www.cve.org/CVERecord?id=CVE-2024-4418
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=2278616
> [2] https://gitlab.com/libvirt/libvirt/-/commit/8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore
> 
> _______________________________________________
> Pkg-libvirt-maintainers mailing list
> Pkg-libvirt-maintainers@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-libvirt-maintainers
> 

Message #15 received at 1070330@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Guido Günther <agx@sigxcpu.org>

Cc: 1070330@bugs.debian.org

Subject: Re: [Pkg-libvirt-maintainers] Bug#1070330: libvirt: CVE-2024-4418: stack use-after-free in virNetClientIOEventLoop()

Date: Fri, 3 May 2024 22:09:34 +0200

Hi Guido,

On Fri, May 03, 2024 at 09:47:30PM +0200, Guido Günther wrote:
> control: -1 +pending
> 
> Hi,
> On Fri, May 03, 2024 at 09:10:23PM +0200, Salvatore Bonaccorso wrote:
> > Source: libvirt
> > Version: 10.2.0-1
> > Severity: important
> > Tags: security upstream
> > X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> > 
> > Hi,
> > 
> > The following vulnerability was published for libvirt.
> > 
> > CVE-2024-4418[0]:
> > | stack use-after-free in virNetClientIOEventLoop()
> > 
> > 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> See https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/220

Ah, very nice. Thanks!

Regards,
Salvatore

Message #18 received at 1070330-submitter@bugs.debian.org (full text, mbox, reply):

From: Andrea Bolognani <noreply@salsa.debian.org>

To: 1070330-submitter@bugs.debian.org

Subject: Bug#1070330 marked as pending in libvirt

Date: Sat, 04 May 2024 09:12:09 +0000

Control: tag -1 pending

Hello,

Bug #1070330 in libvirt reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/libvirt-team/libvirt/-/commit/be65bee8301960bdfed2171b6b7f8b1bc3c980bf

------------------------------------------------------------------------
patches: Add backport/rpc-ensure-temporary-GSource-is-removed-from-client-event.patch

CVE-2024-4418

Closes: #1070330
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1070330

Message #25 received at 1070330-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1070330-close@bugs.debian.org

Subject: Bug#1070330: fixed in libvirt 10.3.0-1

Date: Sat, 04 May 2024 10:10:36 +0000

[Message part 1 (text/plain, inline)]

Source: libvirt
Source-Version: 10.3.0-1
Done: Andrea Bolognani <eof@kiyuko.org>

We believe that the bug you reported is fixed in the latest version of
libvirt, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1070330@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrea Bolognani <eof@kiyuko.org> (supplier of updated libvirt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 04 May 2024 00:16:21 +0200
Source: libvirt
Architecture: source
Version: 10.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Libvirt Maintainers <pkg-libvirt-maintainers@lists.alioth.debian.org>
Changed-By: Andrea Bolognani <eof@kiyuko.org>
Closes: 1070330
Changes:
 libvirt (10.3.0-1) unstable; urgency=medium
 .
   * [7845089] New upstream version 10.3.0
   * [be65bee] patches: Add backport/rpc-ensure-temporary-GSource[...]
     - Fixes CVE-2024-4418 (Closes: #1070330)
Checksums-Sha1:
 69180e49e3794048d14feccdc290f427f8a91233 5996 libvirt_10.3.0-1.dsc
 7dbf01ec1adff85b16437b559b6023d36334fc37 9476852 libvirt_10.3.0.orig.tar.xz
 f876a546f4f3b3d87f78f39d3c37ceea5d0fe61a 833 libvirt_10.3.0.orig.tar.xz.asc
 e93bd975fecfe1109ae26c176171380d002d1f1f 89908 libvirt_10.3.0-1.debian.tar.xz
 46713c9b2e2e42aca98044578a065831bd198221 12575 libvirt_10.3.0-1_source.buildinfo
Checksums-Sha256:
 64a2f7aa3555f277303eb7fbcdf913e7c0f21b680453fbaa65237a3a89aad831 5996 libvirt_10.3.0-1.dsc
 2af5a50b6b1027822b6344e35080fa78cc8266f821a3ae6f8f372f18dd049018 9476852 libvirt_10.3.0.orig.tar.xz
 0007e1d0c26366cd433569646b525fa36a0b62bc87fcb4a9077720a87b7f7f3a 833 libvirt_10.3.0.orig.tar.xz.asc
 922d1dc84f30174faf228339bd075ac54e293ea799421bcde4cb2aecf9db4a23 89908 libvirt_10.3.0-1.debian.tar.xz
 0242a041f10210cff64edd28d0675694efce0a04092fa2bd1da1d41edd5224fb 12575 libvirt_10.3.0-1_source.buildinfo
Files:
 faecaedfba8cbcfea3e01df69b649c67 5996 libs optional libvirt_10.3.0-1.dsc
 046625ca97f32aaf06737fa1ede6d018 9476852 libs optional libvirt_10.3.0.orig.tar.xz
 2ffea4261f5c4114e90c78731c221520 833 libs optional libvirt_10.3.0.orig.tar.xz.asc
 a4a19ec2b59654c7bcaff42cd1be5a63 89908 libs optional libvirt_10.3.0-1.debian.tar.xz
 7cdaea9f4d32e0eef12ea61031401009 12575 libs optional libvirt_10.3.0-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEO48t9niVypx3EjLf954fxUKFg6wFAmY2At8ACgkQ954fxUKF
g6zzyw/+LZtlVybVBjz0RJTkqB7UoW3u0y2i7/7XPQ5HIyGsG4rIPCP5w6hRRV1k
xHR1u/v4dd7Nrj4nCwX7d2mSA+KKi4LltM3MeTDCnEHRjeeNVKHugc34I0/QkWp1
IFU1gcwUwRN/WkHDWxOuq3zDSXB1uaTrkvkVpG+7pbaSk2egohINFW94foFLDAWR
HAvxtTTezAccvlNPJhl/NW0Id3MJizz+Uku70C25fpbrWjkfoZkvesmEmc2/ocMG
IVJpUdqE1d3c76nMNut8JpGJs5CAN7jO8JQz9HMHIsF4Xq8SwXzxxRTExJpgS1T+
cMmQlKFcOD8kGa+QRlybOkA3d2wLo9I2lMFXvSYAB7tDDuGex+08R2PBOaQMQykj
kOK8lkGqfFjU8mzDpcoC8MYVaBWifG5M1do9dhdcPsnCETCHOc6lgkF/PzMdlNaK
Zu0K3xAriW6ruLPspbWqO13WHMc/jBCAPODl0+DciiyFiw7SfWpuZQu344uvQTBZ
Is2J4DkDAKhptaGgajc+Ya1WMCttzoXKrnkpMPU3DICoXN9mv/9WaEXQMm/7fAxY
AIDnSrWPDAeuEB3K3GqlsNDfCw2bpQsgUmuvj7DVdHDLWOtsnCwMsbxIe+10NMv+
W2Kko1ai9h07Vu88PI3d0OMtJRU/eYF2Ya6wDn39mHh8m3aZzAY=
=22dc
-----END PGP SIGNATURE-----

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.