Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: [email protected] Control: affects -1 + src:spice-vdagent User: [email protected] Usertags: pu
Dear stable release managers, please consider spice-vdagent/0.22.1-4.1+deb13u1 for trixie [ Reason ] Two CVEs CVE-2026-57965 and CVE-2026-57966 reported against spice-vdagent [ Impact ] CVE-2026-57965 is a heap buffer overflow and CVE-2026-57966 is path traversal vulnerability. [ Tests ] The package lack testsuite. [ Risks ] The security fix backported from upstream version 0.23.0 and the changes compared to the version in stable is minimal and because of that patch fit nicely [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] (Explain *all* the changes) [ Other info ] (Anything else the release team should know.)
diff -Nru spice-vdagent-0.22.1/debian/changelog spice-vdagent-0.22.1/debian/changelog --- spice-vdagent-0.22.1/debian/changelog 2024-07-17 22:22:52.000000000 +0530 +++ spice-vdagent-0.22.1/debian/changelog 2026-07-29 13:50:19.000000000 +0530 @@ -1,3 +1,11 @@ +spice-vdagent (0.22.1-4.1+deb13u1) trixie; urgency=medium + + * Fix CVE-2026-57965: Heap buffer overflow (Closes: #1141318) + * Fix CVE-2026-57966: Path traversal vulnerability. + (Closes: #1141317) + + -- Abhijith PA <[email protected]> Wed, 29 Jul 2026 13:50:19 +0530 + spice-vdagent (0.22.1-4.1) unstable; urgency=medium * Non-maintainer upload. diff -Nru spice-vdagent-0.22.1/debian/patches/CVE-2026-57965.patch spice-vdagent-0.22.1/debian/patches/CVE-2026-57965.patch --- spice-vdagent-0.22.1/debian/patches/CVE-2026-57965.patch 1970-01-01 05:30:00.000000000 +0530 +++ spice-vdagent-0.22.1/debian/patches/CVE-2026-57965.patch 2026-07-29 13:49:23.000000000 +0530 @@ -0,0 +1,37 @@ +From e379398607671764b23e92cb81b7fa729ba64a3c Mon Sep 17 00:00:00 2001 +From: Vinz Spring <[email protected]> +Date: Fri, 17 Jul 2026 13:55:32 +0000 +Subject: [PATCH] fix(udscs): Prevent integer overflow in udscs_write() + buf_size calculation + +Add a bounds check rejecting messages where size > UINT32_MAX - sizeof(header) +before computing buf_size = sizeof(header) + size. This prevents the 32-bit +unsigned integer wraparound that leads to a tiny allocation followed by a +massive heap-buffer-overflow memcpy, crashing the daemon (DoS). + +CVE: CVE-2026-57965 +--- + src/udscs.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/udscs.c b/src/udscs.c +index 6c50f76..4b121ff 100644 +--- a/src/udscs.c ++++ b/src/udscs.c +@@ -141,6 +141,13 @@ void udscs_write(UdscsConnection *conn, uint32_t type, uint32_t arg1, + guint buf_size; + struct udscs_message_header header; + ++ /* CVE-2026-57965: Prevent integer overflow in buf_size calculation. ++ * sizeof(header) + size must not wrap a 32-bit unsigned integer. */ ++ if (size > UINT32_MAX - sizeof(header)) { ++ syslog(LOG_ERR, "udscs_write: message size %u too large, dropping", size); ++ return; ++ } ++ + buf_size = sizeof(header) + size; + buf = g_malloc(buf_size); + +-- +GitLab + diff -Nru spice-vdagent-0.22.1/debian/patches/CVE-2026-57966.patch spice-vdagent-0.22.1/debian/patches/CVE-2026-57966.patch --- spice-vdagent-0.22.1/debian/patches/CVE-2026-57966.patch 1970-01-01 05:30:00.000000000 +0530 +++ spice-vdagent-0.22.1/debian/patches/CVE-2026-57966.patch 2026-07-29 13:49:33.000000000 +0530 @@ -0,0 +1,95 @@ +From c2eaec460acb555d4c0ceb244a0782b50745b278 Mon Sep 17 00:00:00 2001 +From: Vinz Spring <[email protected]> +Date: Fri, 17 Jul 2026 13:55:37 +0000 +Subject: [PATCH] fix(file-xfers): Reject path traversal in file transfer + filenames + +Add is_safe_filename() validation in vdagent_file_xfers_create_file() that +rejects filenames containing '..' path components or absolute paths. This +prevents a malicious SPICE host from writing arbitrary files outside the +intended save directory via crafted file transfer names. + +CVE: CVE-2026-57966 +--- + src/vdagent/file-xfers.c | 29 +++++++++++++++++++++++++++++ + tests/test-file-xfers.c | 10 ++++++++++ + 2 files changed, 39 insertions(+) + +diff --git a/src/vdagent/file-xfers.c b/src/vdagent/file-xfers.c +index 4898fc0..2c3fac7 100644 +--- a/src/vdagent/file-xfers.c ++++ b/src/vdagent/file-xfers.c +@@ -22,6 +22,7 @@ + + #include <stdio.h> + #include <stdlib.h> ++#include <stdbool.h> + #include <inttypes.h> + #include <string.h> + #include <syslog.h> +@@ -178,6 +179,29 @@ static uint64_t get_free_space_available(const char *path) + return stat.f_bsize * stat.f_bavail; + } + ++/* File transfers may contain relative subdirectories, but must remain below ++ * the configured save directory. */ ++static bool ++is_safe_relative_path(const char *filename) ++{ ++ const char *component = filename; ++ ++ if (filename[0] == '\0' || g_path_is_absolute(filename)) ++ return false; ++ ++ while (component != NULL) { ++ const char *separator = strchr(component, G_DIR_SEPARATOR); ++ size_t length = separator != NULL ? separator - component : strlen(component); ++ ++ if (length == 2 && component[0] == '.' && component[1] == '.') ++ return false; ++ ++ component = separator != NULL ? separator + 1 : NULL; ++ } ++ ++ return true; ++} ++ + int + vdagent_file_xfers_create_file(const char *save_dir, char **file_name_p) + { +@@ -187,6 +211,11 @@ vdagent_file_xfers_create_file(const char *save_dir, char **file_name_p) + int file_fd = -1; + int i; + ++ if (!is_safe_relative_path(*file_name_p)) { ++ syslog(LOG_ERR, "file-xfer: rejecting unsafe filename: %s", *file_name_p); ++ return -1; ++ } ++ + file_path = g_build_filename(save_dir, *file_name_p, NULL); + dir = g_path_get_dirname(file_path); + if (g_mkdir_with_parents(dir, S_IRWXU) == -1) { +diff --git a/tests/test-file-xfers.c b/tests/test-file-xfers.c +index 9995336..b734f91 100644 +--- a/tests/test-file-xfers.c ++++ b/tests/test-file-xfers.c +@@ -64,6 +64,16 @@ int main(int argc, char *argv[]) + // create a file in a subdirectory not existing + test_file("subdir/test.txt", "./test-dir/subdir/test.txt"); + ++ // reject paths that can escape the destination directory ++ test_file("../escape.txt", NULL); ++ test_file("subdir/../../escape.txt", NULL); ++ test_file("/tmp/escape.txt", NULL); ++ test_file("", NULL); ++ ++ // allow dots that are not parent-directory components ++ test_file(".hidden", "./test-dir/.hidden"); ++ test_file("subdir/file..txt", "./test-dir/subdir/file..txt"); ++ + // create a file in a directory with no permissions + assert(system("ln -s /proc/1 test-dir/baddir") == 0); + test_file("baddir/test2.txt", NULL); +-- +GitLab + diff -Nru spice-vdagent-0.22.1/debian/patches/series spice-vdagent-0.22.1/debian/patches/series --- spice-vdagent-0.22.1/debian/patches/series 2023-11-21 12:23:12.000000000 +0530 +++ spice-vdagent-0.22.1/debian/patches/series 2026-07-29 13:49:33.000000000 +0530 @@ -1,2 +1,4 @@ systemd_service_default_file.patch disable_test_session_info.patch +CVE-2026-57965.patch +CVE-2026-57966.patch
