* [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917
@ 2026-10-22 6:35 Roopa Kalmath
0 siblings, 0 replies; 4+ messages in thread
From: Roopa Kalmath @ 2026-10-22 6:35 UTC (permalink / raw)
To: meta-virtualization
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=yes, Size: 4645 bytes --]
Backport commit[1] which fixes this vulnerability as mentioned debian
report in [2].
[1] https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f
[2] https://security-tracker.debian.org/tracker/CVE-2026-18917
Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
.../libvirt/libvirt/CVE-2026-18917.patch | 71 +++++++++++++++++++
recipes-extended/libvirt/libvirt_git.bb | 1 +
2 files changed, 72 insertions(+)
create mode 100644 recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
diff --git a/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
new file mode 100644
index 00000000..8b8b84ab
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
@@ -0,0 +1,71 @@
+From 5a62cbf2907d4590283597b46da9c0f41e7b4d4f Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 12 Aug 2026 16:51:58 +0200
+Subject: [PATCH] remote: Fix integer overflow in RPC handler for
+ virNodeGetFreePages (CVE-2026-18917)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2026-18917
+
+The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'
+argument with the 'cellcount' argument passed to 'virNodeGetFreePages',
+both of which are declared as 'unsigned int' to both do an RPC limit
+check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate
+the memory to hold the result from the actual hypervisor driver.
+
+Since both the values are 'unsigned int' the product is also unsigned
+int so big enough numbers can overflow, both passing the check and also
+allocating not enough memory for the result. The hypervisor driver
+assumes that the passed buffer is large enough and overwrites memory.
+
+When this happens the the hypervisor daemon crashes.
+
+This can be triggered e.g. by passing 1023 and 4198405 as values which
+multiply to 1019 after wrapping to 32 bit unsigned value.
+
+Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue
+the same way as we do for other APIs doing multiplication of arguments
+to determine amount of required memory.
+
+Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d)
+Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903
+
+CVE: CVE-2026-18917
+
+Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f]
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ src/remote/remote_daemon_dispatch.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index 95ab173b7c..e548438250 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -6752,13 +6752,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED,
+ if (!conn)
+ goto cleanup;
+
+- if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
+- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+- _("the result won't fit into REMOTE_NODE_MAX_CELLS"));
++ if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) ||
++ args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
++ virReportError(VIR_ERR_INTERNAL_ERROR,
++ _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"),
++ REMOTE_NODE_MAX_CELLS);
+ goto cleanup;
+ }
+
+- /* Allocate return buffer. */
+ ret->counts.counts_val = g_new0(uint64_t,
+ args->pages.pages_len * args->cellCount);
+
+--
+GitLab
+
diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb
index 34a1ff21..e42bb400 100644
--- a/recipes-extended/libvirt/libvirt_git.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -42,6 +42,7 @@ SRC_URI = "gitsm://github.com/libvirt/libvirt.git;name=libvirt;protocol=https;br
file://0001-messon.build-remove-build-path-information-to-avoid-.patch \
file://0001-tests-meson-clear-absolute-directory-paths.patch \
file://0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch \
+ file://CVE-2026-18917.patch \
"
inherit meson gettext update-rc.d pkgconfig systemd useradd perlnative
--
2.49.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917
@ 2026-10-22 9:37 Roopa Kalmath
0 siblings, 0 replies; 4+ messages in thread
From: Roopa Kalmath @ 2026-10-22 9:37 UTC (permalink / raw)
To: meta-virtualization
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=yes, Size: 4645 bytes --]
Backport commit[1] which fixes this vulnerability as mentioned debian
report in [2].
[1] https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f
[2] https://security-tracker.debian.org/tracker/CVE-2026-18917
Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
.../libvirt/libvirt/CVE-2026-18917.patch | 71 +++++++++++++++++++
recipes-extended/libvirt/libvirt_git.bb | 1 +
2 files changed, 72 insertions(+)
create mode 100644 recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
diff --git a/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
new file mode 100644
index 00000000..8b8b84ab
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
@@ -0,0 +1,71 @@
+From 5a62cbf2907d4590283597b46da9c0f41e7b4d4f Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 12 Aug 2026 16:51:58 +0200
+Subject: [PATCH] remote: Fix integer overflow in RPC handler for
+ virNodeGetFreePages (CVE-2026-18917)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2026-18917
+
+The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'
+argument with the 'cellcount' argument passed to 'virNodeGetFreePages',
+both of which are declared as 'unsigned int' to both do an RPC limit
+check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate
+the memory to hold the result from the actual hypervisor driver.
+
+Since both the values are 'unsigned int' the product is also unsigned
+int so big enough numbers can overflow, both passing the check and also
+allocating not enough memory for the result. The hypervisor driver
+assumes that the passed buffer is large enough and overwrites memory.
+
+When this happens the the hypervisor daemon crashes.
+
+This can be triggered e.g. by passing 1023 and 4198405 as values which
+multiply to 1019 after wrapping to 32 bit unsigned value.
+
+Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue
+the same way as we do for other APIs doing multiplication of arguments
+to determine amount of required memory.
+
+Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d)
+Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903
+
+CVE: CVE-2026-18917
+
+Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f]
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ src/remote/remote_daemon_dispatch.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index 95ab173b7c..e548438250 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -6752,13 +6752,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED,
+ if (!conn)
+ goto cleanup;
+
+- if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
+- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+- _("the result won't fit into REMOTE_NODE_MAX_CELLS"));
++ if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) ||
++ args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
++ virReportError(VIR_ERR_INTERNAL_ERROR,
++ _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"),
++ REMOTE_NODE_MAX_CELLS);
+ goto cleanup;
+ }
+
+- /* Allocate return buffer. */
+ ret->counts.counts_val = g_new0(uint64_t,
+ args->pages.pages_len * args->cellCount);
+
+--
+GitLab
+
diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb
index 34a1ff21..e42bb400 100644
--- a/recipes-extended/libvirt/libvirt_git.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -42,6 +42,7 @@ SRC_URI = "gitsm://github.com/libvirt/libvirt.git;name=libvirt;protocol=https;br
file://0001-messon.build-remove-build-path-information-to-avoid-.patch \
file://0001-tests-meson-clear-absolute-directory-paths.patch \
file://0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch \
+ file://CVE-2026-18917.patch \
"
inherit meson gettext update-rc.d pkgconfig systemd useradd perlnative
--
2.49.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917
@ 2026-10-22 9:44 Roopa Kalmath
2026-10-22 19:09 ` Bruce Ashfield
0 siblings, 1 reply; 4+ messages in thread
From: Roopa Kalmath @ 2026-10-22 9:44 UTC (permalink / raw)
To: meta-virtualization
Backport commit[1] which fixes this vulnerability as mentioned debian
report in [2].
[1] https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f
[2] https://security-tracker.debian.org/tracker/CVE-2026-18917
Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
.../libvirt/libvirt/CVE-2026-18917.patch | 71 +++++++++++++++++++
recipes-extended/libvirt/libvirt_git.bb | 1 +
2 files changed, 72 insertions(+)
create mode 100644 recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
diff --git a/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
new file mode 100644
index 00000000..8b8b84ab
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2026-18917.patch
@@ -0,0 +1,71 @@
+From 5a62cbf2907d4590283597b46da9c0f41e7b4d4f Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 12 Aug 2026 16:51:58 +0200
+Subject: [PATCH] remote: Fix integer overflow in RPC handler for
+ virNodeGetFreePages (CVE-2026-18917)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2026-18917
+
+The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'
+argument with the 'cellcount' argument passed to 'virNodeGetFreePages',
+both of which are declared as 'unsigned int' to both do an RPC limit
+check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate
+the memory to hold the result from the actual hypervisor driver.
+
+Since both the values are 'unsigned int' the product is also unsigned
+int so big enough numbers can overflow, both passing the check and also
+allocating not enough memory for the result. The hypervisor driver
+assumes that the passed buffer is large enough and overwrites memory.
+
+When this happens the the hypervisor daemon crashes.
+
+This can be triggered e.g. by passing 1023 and 4198405 as values which
+multiply to 1019 after wrapping to 32 bit unsigned value.
+
+Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue
+the same way as we do for other APIs doing multiplication of arguments
+to determine amount of required memory.
+
+Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d)
+Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903
+
+CVE: CVE-2026-18917
+
+Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/5a62cbf2907d4590283597b46da9c0f41e7b4d4f]
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ src/remote/remote_daemon_dispatch.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index 95ab173b7c..e548438250 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -6752,13 +6752,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED,
+ if (!conn)
+ goto cleanup;
+
+- if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
+- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+- _("the result won't fit into REMOTE_NODE_MAX_CELLS"));
++ if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) ||
++ args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) {
++ virReportError(VIR_ERR_INTERNAL_ERROR,
++ _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"),
++ REMOTE_NODE_MAX_CELLS);
+ goto cleanup;
+ }
+
+- /* Allocate return buffer. */
+ ret->counts.counts_val = g_new0(uint64_t,
+ args->pages.pages_len * args->cellCount);
+
+--
+GitLab
+
diff --git a/recipes-extended/libvirt/libvirt_git.bb b/recipes-extended/libvirt/libvirt_git.bb
index 34a1ff21..e42bb400 100644
--- a/recipes-extended/libvirt/libvirt_git.bb
+++ b/recipes-extended/libvirt/libvirt_git.bb
@@ -42,6 +42,7 @@ SRC_URI = "gitsm://github.com/libvirt/libvirt.git;name=libvirt;protocol=https;br
file://0001-messon.build-remove-build-path-information-to-avoid-.patch \
file://0001-tests-meson-clear-absolute-directory-paths.patch \
file://0001-qemu_nbdkit.c-use-llu-to-print-time_t.patch \
+ file://CVE-2026-18917.patch \
"
inherit meson gettext update-rc.d pkgconfig systemd useradd perlnative
--
2.49.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917
2026-10-22 9:44 [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917 Roopa Kalmath
@ 2026-10-22 19:09 ` Bruce Ashfield
0 siblings, 0 replies; 4+ messages in thread
From: Bruce Ashfield @ 2026-10-22 19:09 UTC (permalink / raw)
To: meta-virtualization; +Cc: Roopa.Kalmath
merged
Bruce
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-22 19:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-22 9:44 [meta-virtualization][wrynose][PATCH] libvirt: fix CVE-2026-18917 Roopa Kalmath
2026-10-22 19:09 ` Bruce Ashfield
-- strict thread matches above, loose matches on Subject: below --
2026-10-22 9:37 Roopa Kalmath
2026-10-22 6:35 Roopa Kalmath
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.