Bug 916497 (CVE-2023-3750) – <app-emulation/libvirt-{9.3.0-r1,9.4.0-r4,9.5.0-r1,9.6.0}: libvirt daemon crash

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2023-10-29 18:56:21 UTC]

CVE-2023-3750:

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.

[Comment 1 Larry the Git Cow 2023-10-31 16:25:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=42fd27c7046a483b588a8e4e59f6ab8c1d2edcc2

commit 42fd27c7046a483b588a8e4e59f6ab8c1d2edcc2
Author:     Michal Privoznik <[e-mail]>
AuthorDate: 2023-10-31 09:00:44 +0000
Commit:     Matthias Maier <[e-mail]>
CommitDate: 2023-10-31 16:25:18 +0000

    app-emulation/libvirt: Backport fix for CVE-2023-3750
    
    A security flaw was identified in <app-emulation/libvirt-9.6.0
    which can result int DoS. The upstream is fixed from 9.6.0.
    Backport the fix to older versions found in portage.
    
    Bug: https://bugs.gentoo.org/916497
    Closes: https://github.com/gentoo/gentoo/pull/33604
    Signed-off-by: Michal Privoznik <[e-mail]>
    Signed-off-by: Matthias Maier <[e-mail]>

 ...-returning-of-locked-objects-from-virStor.patch | 57 ++++++++++++++++++++++
 ...ibvirt-9.3.0.ebuild => libvirt-9.3.0-r1.ebuild} |  1 +
 ...irt-9.4.0-r3.ebuild => libvirt-9.4.0-r4.ebuild} |  1 +
 ...ibvirt-9.5.0.ebuild => libvirt-9.5.0-r1.ebuild} |  1 +
 4 files changed, 60 insertions(+)

[Comment 2 Matthias Maier 2023-10-31 16:27:50 UTC]

All versions remaining in the tree (including stable versions) are fixed.

[Comment 3 Larry the Git Cow 2024-12-11 08:41:37 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=13edb9df7edffbb08f4197f6bf3f4a252308ca96

commit 13edb9df7edffbb08f4197f6bf3f4a252308ca96
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-12-11 08:41:12 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-12-11 08:41:34 +0000

    [ GLSA 202412-16 ] libvirt: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/908042
    Bug: https://bugs.gentoo.org/916497
    Bug: https://bugs.gentoo.org/929966
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202412-16.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)