+-- On Fri, 28 Jun 2019, Daniel P. Berrangé wrote --+ | Can you elaborate on the way to exploit this as I'm not seeing | any way that doesn't involve mis-configuration of the ACL | config file data.
True, it depends on having an 'allow all' rule. If the bridge.conf had an 'allow all' rule below == deny BridgeLength0xF allow all == And user supplied name as --br=BridgeLength0xFun if (strcmp(bridge, acl_rule->iface) == 0) { the strcmp(3) above would not match the deny ACL rule, because given bridge name is longer. And qemu-bridge-helper would go on to connect the tap device with a bridge that is configured to have access denied. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F