Re: [Qemu-devel] [PATCH] qemu-bridge-helper: restrict bridge name to IFNAMSIZ

[P J P]

+-- On Fri, 28 Jun 2019, Daniel P. Berrangé wrote --+
| Can you elaborate on the way to exploit this as I'm not seeing
| any way that doesn't involve mis-configuration of the ACL
| config file data.

True, it depends on having an 'allow all' rule. If the bridge.conf had an 
'allow all' rule below

==
deny BridgeLength0xF
allow all
==

And user supplied name as --br=BridgeLength0xFun

    if (strcmp(bridge, acl_rule->iface) == 0) {

the strcmp(3) above would not match the deny ACL rule, because given bridge 
name is longer. And qemu-bridge-helper would go on to connect the tap device 
with a bridge that is configured to have access denied.


Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F