Re: [PATCH] log: fix deadlock obtaining hostname (related CVE-2018-6764)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Feb 12, 2018 at 11:52:43AM +0100, Michal Privoznik wrote:
> On 02/12/2018 11:08 AM, Daniel P. Berrangé wrote:
> > The fix for CVE-2018-6764 introduced a potential deadlock scenario
> > that gets triggered by the NSS module when virGetHostname() calls
> > getaddrinfo to resolve the hostname:
> > 
> >  #0  0x00007f6e714b57e7 in futex_wait
> >  #1  futex_wait_simple
> >  #2  __pthread_once_slow
> >  #3  0x00007f6e71d16e7d in virOnce
> >  #4  0x00007f6e71d0997c in virLogInitialize
> >  #5  0x00007f6e71d0a09a in virLogVMessage
> >  #6  0x00007f6e71d09ffd in virLogMessage
> >  #7  0x00007f6e71d0db22 in virObjectNew
> >  #8  0x00007f6e71d0dbf1 in virObjectLockableNew
> >  #9  0x00007f6e71d0d3e5 in virMacMapNew
> >  #10 0x00007f6e71cdc50a in findLease
> >  #11 0x00007f6e71cdcc56 in _nss_libvirt_gethostbyname4_r
> >  #12 0x00007f6e724631fc in gaih_inet
> >  #13 0x00007f6e72464697 in __GI_getaddrinfo
> >  #14 0x00007f6e71d19e81 in virGetHostnameImpl
> >  #15 0x00007f6e71d1a057 in virGetHostnameQuiet
> >  #16 0x00007f6e71d09936 in virLogOnceInit
> >  #17 0x00007f6e71d09952 in virLogOnce
> >  #18 0x00007f6e714b5829 in __pthread_once_slow
> >  #19 0x00007f6e71d16e7d in virOnce
> >  #20 0x00007f6e71d0997c in virLogInitialize
> >  #21 0x00007f6e71d0a09a in virLogVMessage
> >  #22 0x00007f6e71d09ffd in virLogMessage
> >  #23 0x00007f6e71d0db22 in virObjectNew
> >  #24 0x00007f6e71d0dbf1 in virObjectLockableNew
> >  #25 0x00007f6e71d0d3e5 in virMacMapNew
> >  #26 0x00007f6e71cdc50a in findLease
> >  #27 0x00007f6e71cdc839 in _nss_libvirt_gethostbyname3_r
> >  #28 0x00007f6e71cdc724 in _nss_libvirt_gethostbyname2_r
> >  #29 0x00007f6e7248f72f in __gethostbyname2_r
> >  #30 0x00007f6e7248f494 in gethostbyname2
> >  #31 0x000056348c30c36d in hosts_keys
> >  #32 0x000056348c30b7d2 in main
> > 
> > Fortunately the extra stuff virGetHostname does is totally irrelevant to
> > the needs of the logging code, so we can just inline a call to the
> > native hostname() syscall directly.
> > 
> > Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
> > ---
> >  src/util/virlog.c | 20 ++++++++++++++------
> >  1 file changed, 14 insertions(+), 6 deletions(-)
> 
> ACK

FYI I'll also squash in a change to cfg.mk to avoid syntax-check failure

diff --git a/cfg.mk b/cfg.mk
index 78f805b27e..920b609172 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -1183,7 +1183,7 @@ _src2=src/(util/vircommand|libvirt|lxc/lxc_controller|locking/lock_daemon|loggin
 exclude_file_name_regexp--sc_prohibit_fork_wrappers = \
   (^($(_src2)|tests/testutils|daemon/libvirtd)\.c$$)
 
-exclude_file_name_regexp--sc_prohibit_gethostname = ^src/util/virutil\.c$$
+exclude_file_name_regexp--sc_prohibit_gethostname = ^src/util/vir(util|log)\.c$$
 
 exclude_file_name_regexp--sc_prohibit_internal_functions = \
   ^src/(util/(viralloc|virutil|virfile)\.[hc]|esx/esx_vi\.c)$$


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux