From c116ca968e552f079e1ebfe855b4bfa02d368f74 Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Wed, 12 Aug 2015 21:03:11 +0530 Subject: [PATCH] CLOUDSTACK-8613, CLOUDSTACK-6301: Dump KVM domain XML with secure flag When dumping XML use appropriate flags: 1, VIR_DOMAIN_XML_SECURE (dump security sensitive information too) 8, VIR_DOMAIN_XML_MIGRATABLE (dump XML suitable for migration) Source: https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags This fixes CVE 2015-3252: VNC password lost during VM migration across KVM hosts. The issue is also seen when a VM is rebooted. Signed-off-by: Rohit Yadav (cherry picked from commit cb2aca751630ea60ad2fffed3d12e3fa2a5e93b5) Signed-off-by: Rohit Yadav Conflicts: plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java --- .../kvm/resource/LibvirtComputingResource.java | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java index 0d441095c70..0f1e2e71d1f 100755 --- a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java +++ b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java @@ -3011,8 +3011,13 @@ ServerResource { description for the instance to be used on the target host. This is supported by libvirt-java from version 0.50.0 - */ - xmlDesc = dm.getXMLDesc(0).replace(_privateIp, cmd.getDestinationIp()); + + CVE-2015-3252: Get XML with sensitive information suitable for migration by using + VIR_DOMAIN_XML_MIGRATABLE flag (value = 8) + https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags + */ + + xmlDesc = dm.getXMLDesc(8).replace(_privateIp, cmd.getDestinationIp()); dconn = new Connect("qemu+tcp://" + cmd.getDestinationIp() + "/system"); @@ -4625,7 +4630,10 @@ ServerResource { String msg = null; try { dm = conn.domainLookupByName(vmName); - String vmDef = dm.getXMLDesc(0); + // Get XML Dump including the secure information such as VNC password + // By passing 1, or VIR_DOMAIN_XML_SECURE flag + // https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags + String vmDef = dm.getXMLDesc(1); LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser(); parser.parseDomainXML(vmDef); for (InterfaceDef nic :parser.getInterfaces()) {