From cb2aca751630ea60ad2fffed3d12e3fa2a5e93b5 Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Wed, 12 Aug 2015 21:03:11 +0530 Subject: [PATCH] CLOUDSTACK-8613, CLOUDSTACK-6301: Dump KVM domain XML with secure flag When dumping XML use appropriate flags: 1, VIR_DOMAIN_XML_SECURE (dump security sensitive information too) 8, VIR_DOMAIN_XML_MIGRATABLE (dump XML suitable for migration) Source: https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags This fixes CVE 2015-3252: VNC password lost during VM migration across KVM hosts. The issue is also seen when a VM is rebooted. Signed-off-by: Rohit Yadav --- .../kvm/resource/LibvirtComputingResource.java | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java index 4ceccaaae12..acd5e947956 100755 --- a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java +++ b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java @@ -3094,8 +3094,13 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv description for the instance to be used on the target host. This is supported by libvirt-java from version 0.50.0 + + CVE-2015-3252: Get XML with sensitive information suitable for migration by using + VIR_DOMAIN_XML_MIGRATABLE flag (value = 8) + https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags + */ - xmlDesc = dm.getXMLDesc(0).replace(_privateIp, cmd.getDestinationIp()); + xmlDesc = dm.getXMLDesc(8).replace(_privateIp, cmd.getDestinationIp()); dconn = new Connect("qemu+tcp://" + cmd.getDestinationIp() + "/system"); @@ -4510,7 +4515,10 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv String msg = null; try { dm = conn.domainLookupByName(vmName); - String vmDef = dm.getXMLDesc(0); + // Get XML Dump including the secure information such as VNC password + // By passing 1, or VIR_DOMAIN_XML_SECURE flag + // https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags + String vmDef = dm.getXMLDesc(1); LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser(); parser.parseDomainXML(vmDef); for (InterfaceDef nic : parser.getInterfaces()) {