REDHAT-BUG-2520161: Integer Overflow
An integer overflow vulnerability was found in libvirt's NodeGetFreePages RPC handler in src/remote/remotedaemondispatch.c. The dispatcher computes a 32-bit product (pageslen cellCount) for both validation and memory allocation. While pageslen is XDR-capped at 1024, cellCount remains unbounded. The multiplication truncates modulo 2^32, allowing crafted values to bypass the guard check. The undersized buffer is then overwritten with real NUMA node data. The RPC call requires only connect:read ACL (lowest permission tier) and is accessible via the world-readable Unix socket (mode 0666) with no authentication for VIRCONNECTRO clients. An unprivileged local user could exploit this to corrupt the root libvirt daemon's heap, leading to denial of service or potentially local privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What level of access is needed to invoke the vulnerable RPC handler?
The call requires only the connect:read ACL, which is the lowest permission tier. VIR_CONNECT_RO clients can access it without authentication through the world-readable Unix socket configured with mode 0666.
What inputs make the overflow possible?
An attacker can supply crafted page and cell-count values such that the 32-bit pages_len multiplied by cellCount calculation wraps. Although pages_len is capped by XDR at 1024, cellCount is not bounded.
What is the practical impact if exploitation succeeds?
The undersized allocation can be overwritten with real NUMA node data in the root libvirt daemon's heap. This can cause denial of service and may permit local privilege escalation.