From nobody Tue Sep 22 20:34:48 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783681913; cv=none; d=zohomail.com; s=zohoarc; b=JRlNfi5+Hp4h998zkdE4+u+TGKaIEmxzR6S0/8KdOpF8tR08H5lRQcYio8wduJMVzZd/AJo58bH/G1tdZdcQ8aAB9aPZxuyIdXQncbew7rg/eE+Is4FfaiUjZk/gjNSipf1OcJ+mWP1CwKOEvjI2+FvNDDcU4X2L5LaMDBJ7Gog= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783681913; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=cJvxPWdUKmcgVnNOhuDPNjtFzcPZY7WLBUJ+nVdaVJsiKYOf5TC/SRhHH2Wy50YtLl22dcGdt1kaAQIoVih1aVlcF2rHOkiuh3WuNbuUBkPB0+H5jkFNUlBk62cFs+JNHfSv/dx5seKAbclykjOM1QtSRZaaRkTcOE+MP9wk7T4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783681913889645.528102826559; Fri, 10 Jul 2026 04:11:53 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AB80241C61; Fri, 10 Jul 2026 07:11:52 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 94D8341C5A; Fri, 10 Jul 2026 07:09:33 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id CD2B341BA4; Fri, 10 Jul 2026 07:07:13 -0400 (EDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 2ACCC41B65 for ; Fri, 10 Jul 2026 07:07:13 -0400 (EDT) Received: by mail-qk1-x729.google.com with SMTP id af79cd13be357-9204711e831so63724685a.2 for ; Fri, 10 Jul 2026 04:07:13 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:11 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681632; x=1784286432; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=aBOG1kD1DvS0zH0ySRfSAHcW9MKeCpxo8zwBGU1j50qBC7bk0yIczpFfJLIq9fBP1Q TqInU9LXpRnCmUbQO4lQyGpsiJK0edmMcnR210sgGPBa6lPKjSwKaYN+YCchF39z60q/ pJJadFXSnZ4639nK2Fxf28wycfsmLPss/ra+g7unT1NjjRuGbwmIP4pGpvQD0IKzWISg +niKWmnFDlqX0PupYgSqkWcq723wLwZTVLtLgyzXw1XIWORBiqBgOOZfWwSnyPQYQXtN hICLIzvMFQ8O2ha5l+Mip8D7qp6yEyUYpJ7rGbgBnv/U2LowGrhQ4EfEPYfPawR12jLA fw7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681632; x=1784286432; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=lo01Z08ipsVFuHNwKUbn1+G7VN44cC9/wTpdwSl+w+xJaRBPYwjFP7Fch8nFMeudxn PtEbRE9dpWimst8b7GHcXhMInKUW4wzBcNQstchXxO1oGajKH4L88d6OXJreauYSP/Jk xGxLT+oEHIa3L6ea+iMokBe37OCViK3A1x8Vb4/9s2AoTkPuTeRS+eWX9OSFXT5dD4sU ZSJB/3zMJjpFy3A55MT1BaiTs9YXnTgKLNIZQ2wA3HiRgu99jVifE1qpMPL/smJA2HLh YZWezb54tEAg0+c4+6z0/mtEWq0o9It+c9FVMCoucnFoajIiTKCRYsXTQ8h+FCHghyHk t5SA== X-Gm-Message-State: AOJu0YwQatkdlYEsxRpHNNY8n4B/ubSxVXP8UZpYeMwHqkia9oJFn9zo fXsuoGPRBldcZIjB2cNj+tfp4CfVqsxYVtgqrQQvP5zZ5vZ/aSYdVVf7HxoncnW9Ms4= X-Gm-Gg: AfdE7cklOwtodtAn+RG4KS8dJC+YjTfVVBAhRi5Zb+Pn2qhVYaxrYby1Bdt35/UYwYz w5m1I9uqSysabb7LDunriKHQx/g5mivCSkH689L1uXKr4QKvBDPH+/i6042T8pgfzuNniA002/l yfPUK3Aske075xP8aD0dl4idRbV+tu/F47KWEJKl1y056up48el4ih/x+ZhczkukPYVLJ0Ayt8p 6Iw5HCGweJ/ID7ukXReFHwZa1SKwExbCiqfrg1ScvZ4e+Ox5Dmtd7BXNPxmWk8p4hTGdIik3gn4 I6RlWWhP5AxwRqDOYQmdwG88BEnUm+VmSnCTGMlRCqSWpSdmT9LYUIU0bL8uNMkNtnix6iE7+ai wbcte7BzZfmOyu3OxpnfzEGYJ+bBNC7TWuxifayekj8P2UDrZNZPsv2i1aHwzr+9pzmO5n6tU1d wmaEiqIi5H4pz6XGZdbn1qmXVJ8OAJnOf3khgU1UYfF4r9WzB976DwVzkf61dnsA2Jbvg7+Xpm6 cI6w4ePUSKYV2m+LKqm4dpc7BUcN5vs X-Received: by 2002:a05:620a:8085:b0:910:87f4:9a26 with SMTP id af79cd13be357-92ecf6988a0mr1168024585a.41.1783681632451; Fri, 10 Jul 2026 04:07:12 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 1/4] conf: reject line breaks in DNS TXT record values Date: Fri, 10 Jul 2026 07:06:58 -0400 Message-ID: <20260710110701.278146-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: 5ZJT5BK73AWXSRJ42DXBLSRPYCGVDDXJ X-Message-ID-Hash: 5ZJT5BK73AWXSRJ42DXBLSRPYCGVDDXJ X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783681915478158500 Content-Type: text/plain; charset="utf-8" The network XML schema exposes typed DNS records through the element. The TXT value attribute accepts XML numeric character references, including (LF) and (CR), which survive attribute-value normalization. The network driver later writes the value verbatim into dnsmasq's line-oriented configuration file as a txt-record=3D line, so an embedded line break ends that directive and starts a new one under attacker control. This is a real boundary where a management layer permits editing typed DNS records while withholding the raw passthrough: the injected line escapes that restriction. Direct read-write access to the libvirt socket is already root-equivalent, so for the default deployment this is schema-correctness hardening. Add a helper that rejects LF and CR and call it for the TXT value during XML parsing. CVE-2026-61477 Fixes: 8b32c80df089 ("network: put dnsmasq parameters in conf-file instead = of command line") Signed-off-by: Michael Bommarito --- src/conf/network_conf.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index abd4c6eb4e..307ab0ae24 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -724,6 +724,23 @@ virNetworkDNSHostDefParseXML(const char *networkName, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" \ "_-+/*" =20 + +static int +virNetworkDNSDefCheckLineBreaks(const char *record, + const char *field, + const char *value) +{ + if (virStringHasChars(value, "\r\n")) { + virReportError(VIR_ERR_XML_DETAIL, + _("invalid line break in DNS %1$s record %2$s attri= bute"), + record, field); + return -1; + } + + return 0; +} + + static int virNetworkDNSSrvDefParseXML(const char *networkName, xmlNodePtr node, @@ -852,6 +869,9 @@ virNetworkDNSTxtDefParseXML(const char *networkName, goto error; } =20 + if (virNetworkDNSDefCheckLineBreaks("TXT", "value", def->value) < 0) + goto error; + if (!(def->name || def->value)) { virReportError(VIR_ERR_XML_DETAIL, _("Missing required name or value in DNS TXT record= of network %1$s"), --=20 2.53.0