On 4/15/20 5:22 PM, Michael Roth wrote:
From: Philippe Mathieu-Daudé <phi...@redhat.com>

On [*] Daniel Berrangé commented:

   The QEMU guest agent protocol is not sensible way to access huge
   files inside the guest. It requires the inefficient process of
   reading the entire data into memory than duplicating it again in
   base64 format, and then copying it again in the JSON serializer /
   monitor code.

   For arbitrary general purpose file access, especially for large
   files, use a real file transfer program or use a network block
   device, not the QEMU guest agent.

To avoid bug reports as BZ#1594054 (CVE-2018-12617), follow his
suggestion to put a low, hard limit on "count" in the guest agent
QAPI schema, and don't allow count to be larger than 48 MB.

[*] https://www.mail-archive.com/qemu-devel@nongnu.org/msg693176.html

Fixes: CVE-2018-12617
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1594054
Reported-by: Fakhri Zulkifli <mohdfakhrizulki...@gmail.com>
Suggested-by: Daniel P. Berrangé <berra...@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <phi...@redhat.com>
Reviewed-by: Daniel P. Berrangé <berra...@redhat.com>
*update schema documentation to indicate 48MB limit instead of 10MB

Thanks!

Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com>
---
  qga/commands.c       | 9 ++++++++-
  qga/qapi-schema.json | 6 ++++--
  2 files changed, 12 insertions(+), 3 deletions(-)


Reply via email to