On Wed, Aug 12, 2026 at 05:10:17PM +0200, Peter Krempa via Devel wrote: > From: Peter Krempa <[email protected]> > > CVE-2026-18917 > > The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages' > argument with the 'cellcount' argument passed to 'virNodeGetFreePages', > both of which are declared as 'unsigned int' to both do an RPC limit > check against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate > the memory to hold the result from the actual hypervisor driver. > > Since both the values are 'unsigned int' the product is also unsigned > int so big enough numbers can overflow, both passing the check and also > allocating not enough memory for the result. The hypervisor driver > assumes that the passed buffer is large enough and overwrites memory. > > When this happens the the hypervisor daemon crashes. > > This can be triggered e.g. by passing 1023 and 4198405 as values which > multiply to 1019 after wrapping to 32 bit unsigned value. > > Use the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue > the same way as we do for other APIs doing multiplication of arguments > to determine amount of required memory. > > Fixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d) > Closes: https://gitlab.com/libvirt/libvirt/-/work_items/903 > Signed-off-by: Peter Krempa <[email protected]> > --- > src/remote/remote_daemon_dispatch.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-)
Reviewed-by: Daniel P. Berrangé <[email protected]> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
