* [meta-virtualization][scarthgap][PATCH 1/1] libvirt: fix CVE-2025-13193
@ 2025-11-27 12:37 praveen.kumar
2025-12-02 5:02 ` Bruce Ashfield
0 siblings, 1 reply; 2+ messages in thread
From: praveen.kumar @ 2025-11-27 12:37 UTC (permalink / raw)
To: meta-virtualization
From: Praveen Kumar <praveen.kumar@windriver.com>
A flaw was found in libvirt. External inactive snapshots for
shut-down VMs are incorrectly created as world-readable, making it
possible for unprivileged users to inspect the guest OS contents.
This results in an information disclosure vulnerability.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-13193
Upstream-patch:
https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
---
.../libvirt/libvirt/CVE-2025-13193.patch | 40 +++++++++++++++++++
recipes-extended/libvirt/libvirt_10.0.0.bb | 1 +
2 files changed, 41 insertions(+)
create mode 100644 recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
diff --git a/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch b/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
new file mode 100644
index 00000000..1ce5de38
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
@@ -0,0 +1,40 @@
+From a379327d8abcde8ac8d3e16fe5e4ba6f790d767a Mon Sep 17 00:00:00 2001
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 12 Nov 2025 17:52:05 +0100
+Subject: [PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating
+ external inactive snapshots
+
+External inactive snapshots are created by invoking 'qemu-img' which
+creates the file. Currently qemu-img creates image with mode 644 based
+on default umask as libvirt doesn't set any.
+
+Having a world-readable image is obviously wrong so set the umask to
+077 to have the file readable only by the owner.
+
+Resolves: https://bugs.debian.org/1120119
+
+CVE: CVE-2025-13193
+
+Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ src/qemu/qemu_snapshot.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
+index 73ff533..9819448 100644
+--- a/src/qemu/qemu_snapshot.c
++++ b/src/qemu/qemu_snapshot.c
+@@ -233,6 +233,9 @@ qemuSnapshotCreateQcow2Files(virQEMUDriver *driver,
+ NULL)))
+ return -1;
+
++ /* ensure that new files are only readable by the user */
++ virCommandSetUmask(cmd, 0077);
++
+ /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */
+ virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=",
+ virStorageFileFormatTypeToString(defdisk->src->format));
+--
+2.40.0
diff --git a/recipes-extended/libvirt/libvirt_10.0.0.bb b/recipes-extended/libvirt/libvirt_10.0.0.bb
index 22193ff3..c6e6069c 100644
--- a/recipes-extended/libvirt/libvirt_10.0.0.bb
+++ b/recipes-extended/libvirt/libvirt_10.0.0.bb
@@ -37,6 +37,7 @@ SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
file://CVE-2024-1441.patch \
file://CVE-2024-2494.patch \
file://CVE-2024-4418.patch \
+ file://CVE-2025-13193.patch \
"
SRC_URI[libvirt.sha256sum] = "8ba2e72ec8bdd2418554a1474c42c35704c30174b7611eaf9a16544b71bcf00a"
--
2.40.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [meta-virtualization][scarthgap][PATCH 1/1] libvirt: fix CVE-2025-13193
2025-11-27 12:37 [meta-virtualization][scarthgap][PATCH 1/1] libvirt: fix CVE-2025-13193 praveen.kumar
@ 2025-12-02 5:02 ` Bruce Ashfield
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Ashfield @ 2025-12-02 5:02 UTC (permalink / raw)
To: praveen.kumar; +Cc: meta-virtualization
merged.
Bruce
In message: [meta-virtualization][scarthgap][PATCH 1/1] libvirt: fix CVE-2025-13193
on 27/11/2025 Praveen Kumar via lists.yoctoproject.org wrote:
> From: Praveen Kumar <praveen.kumar@windriver.com>
>
> A flaw was found in libvirt. External inactive snapshots for
> shut-down VMs are incorrectly created as world-readable, making it
> possible for unprivileged users to inspect the guest OS contents.
> This results in an information disclosure vulnerability.
>
> Reference:
> https://nvd.nist.gov/vuln/detail/CVE-2025-13193
>
> Upstream-patch:
> https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a
>
> Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
> ---
> .../libvirt/libvirt/CVE-2025-13193.patch | 40 +++++++++++++++++++
> recipes-extended/libvirt/libvirt_10.0.0.bb | 1 +
> 2 files changed, 41 insertions(+)
> create mode 100644 recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
>
> diff --git a/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch b/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
> new file mode 100644
> index 00000000..1ce5de38
> --- /dev/null
> +++ b/recipes-extended/libvirt/libvirt/CVE-2025-13193.patch
> @@ -0,0 +1,40 @@
> +From a379327d8abcde8ac8d3e16fe5e4ba6f790d767a Mon Sep 17 00:00:00 2001
> +From: Peter Krempa <pkrempa@redhat.com>
> +Date: Wed, 12 Nov 2025 17:52:05 +0100
> +Subject: [PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating
> + external inactive snapshots
> +
> +External inactive snapshots are created by invoking 'qemu-img' which
> +creates the file. Currently qemu-img creates image with mode 644 based
> +on default umask as libvirt doesn't set any.
> +
> +Having a world-readable image is obviously wrong so set the umask to
> +077 to have the file readable only by the owner.
> +
> +Resolves: https://bugs.debian.org/1120119
> +
> +CVE: CVE-2025-13193
> +
> +Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a]
> +
> +Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
> +---
> + src/qemu/qemu_snapshot.c | 3 +++
> + 1 file changed, 3 insertions(+)
> +
> +diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
> +index 73ff533..9819448 100644
> +--- a/src/qemu/qemu_snapshot.c
> ++++ b/src/qemu/qemu_snapshot.c
> +@@ -233,6 +233,9 @@ qemuSnapshotCreateQcow2Files(virQEMUDriver *driver,
> + NULL)))
> + return -1;
> +
> ++ /* ensure that new files are only readable by the user */
> ++ virCommandSetUmask(cmd, 0077);
> ++
> + /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */
> + virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=",
> + virStorageFileFormatTypeToString(defdisk->src->format));
> +--
> +2.40.0
> diff --git a/recipes-extended/libvirt/libvirt_10.0.0.bb b/recipes-extended/libvirt/libvirt_10.0.0.bb
> index 22193ff3..c6e6069c 100644
> --- a/recipes-extended/libvirt/libvirt_10.0.0.bb
> +++ b/recipes-extended/libvirt/libvirt_10.0.0.bb
> @@ -37,6 +37,7 @@ SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
> file://CVE-2024-1441.patch \
> file://CVE-2024-2494.patch \
> file://CVE-2024-4418.patch \
> + file://CVE-2025-13193.patch \
> "
>
> SRC_URI[libvirt.sha256sum] = "8ba2e72ec8bdd2418554a1474c42c35704c30174b7611eaf9a16544b71bcf00a"
> --
> 2.40.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9462): https://lists.yoctoproject.org/g/meta-virtualization/message/9462
> Mute This Topic: https://lists.yoctoproject.org/mt/116499869/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-02 5:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-27 12:37 [meta-virtualization][scarthgap][PATCH 1/1] libvirt: fix CVE-2025-13193 praveen.kumar
2025-12-02 5:02 ` Bruce Ashfield
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.