From dffbc000503fa04f3754084e17e7f9ef82bb3617 Mon Sep 17 00:00:00 2001 From: Cole Robinson Date: Sat, 15 Nov 2014 22:39:45 -0500 Subject: [PATCH] Rebased to version 1.1.3.8 CVE-2014-3633: out-of-bounds read in blockiotune (bz #1160823) CVE-2014-3657: Potential deadlock in domain_conf (bz #1160824) CVE-2014-7823: information leak with migratable flag (bz #1160822) --- ...-Try-harder-to-get-human-readable-ve.patch | 75 ------------------- libvirt.spec | 16 ++-- sources | 2 +- 3 files changed, 9 insertions(+), 84 deletions(-) delete mode 100644 0001-node_device_udev-Try-harder-to-get-human-readable-ve.patch diff --git a/0001-node_device_udev-Try-harder-to-get-human-readable-ve.patch b/0001-node_device_udev-Try-harder-to-get-human-readable-ve.patch deleted file mode 100644 index a11773d..0000000 --- a/0001-node_device_udev-Try-harder-to-get-human-readable-ve.patch +++ /dev/null @@ -1,75 +0,0 @@ -From fb3f5f1b15ba389f47036417e599376d779b4c0b Mon Sep 17 00:00:00 2001 -Message-Id: -From: Lubomir Rintel -Date: Tue, 9 Sep 2014 14:20:43 +0200 -Subject: [PATCH] node_device_udev: Try harder to get human readable - vendor:product - -The manufacurer and product from USB device itself are usually not particularly -useful -- they tend to be missing, or ugly (all-uppercase, padded with spaces, -etc.). Prefer what's in the usb id database and fall back to descriptors only -if the device is too new to be in database. - -https://bugzilla.redhat.com/show_bug.cgi?id=1138887 -(cherry picked from commit 3ef77a544d4313cdfe257717708548f57e6db971) ---- - src/node_device/node_device_udev.c | 27 +++++++++++++++++++++------ - 1 file changed, 21 insertions(+), 6 deletions(-) - -diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c -index 785c2fa..a2f9e57 100644 ---- a/src/node_device/node_device_udev.c -+++ b/src/node_device/node_device_udev.c -@@ -532,6 +532,7 @@ static int udevProcessUSBDevice(struct udev_device *device, - { - union _virNodeDevCapData *data = &def->caps->data; - int ret = -1; -+ int err; - - if (udevGetUintProperty(device, - "BUSNUM", -@@ -554,10 +555,17 @@ static int udevProcessUSBDevice(struct udev_device *device, - goto out; - } - -- if (udevGetStringSysfsAttr(device, -- "manufacturer", -- &data->usb_dev.vendor_name) == PROPERTY_ERROR) { -+ err = udevGetStringProperty(device, -+ "ID_VENDOR_FROM_DATABASE", -+ &data->usb_dev.vendor_name); -+ if (err == PROPERTY_ERROR) - goto out; -+ if (err == PROPERTY_MISSING) { -+ if (udevGetStringSysfsAttr(device, -+ "manufacturer", -+ &data->usb_dev.vendor_name) == PROPERTY_ERROR) { -+ goto out; -+ } - } - - if (udevGetUintProperty(device, -@@ -567,10 +575,17 @@ static int udevProcessUSBDevice(struct udev_device *device, - goto out; - } - -- if (udevGetStringSysfsAttr(device, -- "product", -- &data->usb_dev.product_name) == PROPERTY_ERROR) { -+ err = udevGetStringProperty(device, -+ "ID_MODEL_FROM_DATABASE", -+ &data->usb_dev.product_name); -+ if (err == PROPERTY_ERROR) - goto out; -+ if (err == PROPERTY_MISSING) { -+ if (udevGetStringSysfsAttr(device, -+ "product", -+ &data->usb_dev.product_name) == PROPERTY_ERROR) { -+ goto out; -+ } - } - - if (udevGenerateDeviceName(device, def, NULL) != 0) { --- -2.1.0 - diff --git a/libvirt.spec b/libvirt.spec index 3e1a902..101b5ba 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -366,8 +366,8 @@ Summary: Library providing a simple virtualization API Name: libvirt -Version: 1.1.3.6 -Release: 2%{?dist}%{?extra_release} +Version: 1.1.3.8 +Release: 1%{?dist}%{?extra_release} License: LGPLv2+ Group: Development/Libraries BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -378,9 +378,6 @@ URL: http://libvirt.org/ %endif Source: http://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.gz -# Fix USB device descriptions (bz #1138887) -Patch0001: 0001-node_device_udev-Try-harder-to-get-human-readable-ve.patch - %if %{with_libvirtd} Requires: libvirt-daemon = %{version}-%{release} %if %{with_network} @@ -1164,9 +1161,6 @@ of recent versions of Linux (and other OSes). %prep %setup -q -# Fix USB device descriptions (bz #1138887) -%patch0001 -p1 - %build %if ! %{with_xen} %define _without_xen --without-xen @@ -2124,6 +2118,12 @@ fi %endif %changelog +* Sat Nov 15 2014 Cole Robinson - 1.1.3.8-1 +- Rebased to version 1.1.3.8 +- CVE-2014-3633: out-of-bounds read in blockiotune (bz #1160823) +- CVE-2014-3657: Potential deadlock in domain_conf (bz #1160824) +- CVE-2014-7823: information leak with migratable flag (bz #1160822) + * Thu Oct 30 2014 Cole Robinson - 1.1.3.6-2 - Fix USB device descriptions (bz #1138887) diff --git a/sources b/sources index c91e5a8..3b24e9d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -697405527704dceb30df9db49d81da83 libvirt-1.1.3.6.tar.gz +0f6ac5f7156bafe14641c329ef4dd5ff libvirt-1.1.3.8.tar.gz