From nobody Mon May 6 14:01:23 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1677871259; cv=none; d=zohomail.com; s=zohoarc; b=YiQ17qERx1OcHQoBT4mpcM5kqU7Sd2xjRXTaB1jGCsBo7eIHj7K3fnG/fJEDXjpC+NdhyGCQg6I0hyPz4Tgrx5MdArExo65kxLuP0PdAvQBx9vpRxxXMVIQrvYdA1zy9sI9Jrg/YMYkzd+5gxo8UaWAhOWQWZcHVjmragS3ggVU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1677871259; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=Z3NJSDdK9IidexqUuWYWIIP6h2jYWPfBhqOpNB2Un4c=; b=IIo3iK82jxtyubLk8yTf5K2flHnqnJul6qYVM4pb12v/QSrkkJ2+Qbiwjhy/+027hu7T0m94ihjIH3MXn3b0WafEw7dIpGaJfSGPw5Q0PtWOkKOcDM6pbpm6Yn8I6AVOQLdVkSEJPdTv2PAhcbOwv2dloRGS5jlCvLAeKQk3c7Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1677871259039193.33067393550232; Fri, 3 Mar 2023 11:20:59 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pYAx9-0002E1-1P; Fri, 03 Mar 2023 14:20:27 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pYAx6-0002Az-Hx for qemu-devel@nongnu.org; Fri, 03 Mar 2023 14:20:24 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pYAx4-0003Wl-Vk for qemu-devel@nongnu.org; Fri, 03 Mar 2023 14:20:24 -0500 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-542-6ItuI1w1Ov-TLLSfU7HT7w-1; Fri, 03 Mar 2023 14:20:19 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5A69E800B23; Fri, 3 Mar 2023 19:20:18 +0000 (UTC) Received: from kostyanf14nb.redhat.com (unknown [10.45.224.45]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B55C4140EBF4; Fri, 3 Mar 2023 19:20:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1677871222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Z3NJSDdK9IidexqUuWYWIIP6h2jYWPfBhqOpNB2Un4c=; b=XZYMn+baZ+k9prf6RVZ+9uGJ/HTXeTWlKmJadPhynB2rRixLAS2CwGLKXdY/7xcbtIfxsH Xr5xhAwKlhlLQFk5aO1vVkvDNoNMWr+3zPnFyqWC6AxhAjU0GH/17PsreA5lnSgxyEZclm +fzgbn7ZGUAGzKcQlNf3D7Nudi5KQTo= X-MC-Unique: 6ItuI1w1Ov-TLLSfU7HT7w-1 From: Konstantin Kostiuk To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Daniel=20P=20=2E=20Berrang=C3=A9?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Bin Meng , Stefan Weil , Yonggang Luo , Markus Armbruster , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Peter Maydell , Gerd Hoffmann , "Michael S. Tsirkin" , Thomas Huth , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Roth , Mauro Matteo Cascella , Yan Vugenfirer , Evgeny Iakovlev , Andrey Drobyshev , Xuzhou Cheng , brian.wiltse@live.com Subject: [PATCH v3 1/2] qga/win32: Remove change action from MSI installer Date: Fri, 3 Mar 2023 21:20:07 +0200 Message-Id: <20230303192008.109549-2-kkostiuk@redhat.com> In-Reply-To: <20230303192008.109549-1-kkostiuk@redhat.com> References: <20230303192008.109549-1-kkostiuk@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.1 on 10.11.54.7 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kkostiuk@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1677871260677100001 Content-Type: text/plain; charset="utf-8" Remove the 'change' button from "Programs and Features" because it does not checks if a user is an admin or not. The installer has no components to choose from and always installs everything. So the 'change' button is not obviously needed but can create a security issue. resolves: https://bugzilla.redhat.com/show_bug.cgi?id=3D2167423 fixes: CVE-2023-0664 (part 1 of 2) Signed-off-by: Konstantin Kostiuk Reviewed-by: Yan Vugenfirer Reported-by: Brian Wiltse --- qga/installer/qemu-ga.wxs | 1 + 1 file changed, 1 insertion(+) diff --git a/qga/installer/qemu-ga.wxs b/qga/installer/qemu-ga.wxs index 51340f7ecc..feb629ec47 100644 --- a/qga/installer/qemu-ga.wxs +++ b/qga/installer/qemu-ga.wxs @@ -31,6 +31,7 @@ /> 1 + -- 2.25.1 From nobody Mon May 6 14:01:23 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1677871272; cv=none; d=zohomail.com; s=zohoarc; b=a/o6xEiHjqv1BE7mhsWB45JxjdhQBq9cjoG5IU627VKui3QlBrFQCdYy927M8hI46TUDh2PTmkb3qh6OxbDn9WNwzlprVfoO2OT33VNyyls33dX25neIPolVOJrFIvgwl2xiIphWDnP99sh9l0xCHFRdQ5tWHhpr4oMbeHyhPfE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1677871272; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=n7a42SrubIoXUImbAN8XOyOMoYa67DMUvHOpB/gTJ0M=; b=XtBeKMyOVL+GB2GvUXdsGgkIXqdjirKnsjNbfPrJO09DqIiucKqUc026NLfqWB4472lC6G9k+6sHv5wUu2Nt+HM9uAsKVX27s32U0VDwjQBeAVe6Q5DGRZmu5I5TnqCkbzBCI5QLKGYsNjWGbpe7V7ZRWb3GgcJRq0aQ4Ft1Ap4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1677871272198775.0820822087936; Fri, 3 Mar 2023 11:21:12 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pYAxC-0002FL-4n; Fri, 03 Mar 2023 14:20:30 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pYAxA-0002FB-M4 for qemu-devel@nongnu.org; Fri, 03 Mar 2023 14:20:28 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pYAx9-0003XC-2W for qemu-devel@nongnu.org; Fri, 03 Mar 2023 14:20:28 -0500 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-497-qDQ-jwI8Nome1Jr0grdh0Q-1; Fri, 03 Mar 2023 14:20:23 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 544488027FD; Fri, 3 Mar 2023 19:20:22 +0000 (UTC) Received: from kostyanf14nb.redhat.com (unknown [10.45.224.45]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B9CBE140EBF4; Fri, 3 Mar 2023 19:20:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1677871226; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=n7a42SrubIoXUImbAN8XOyOMoYa67DMUvHOpB/gTJ0M=; b=VSFkuIDaA7vOPZNUB9DSdJd4sPDWgRort10+tw96KsvKRxvpfEllWqzplszujw/0xcPy1L /MAFHoalTB17SoHorO7jzib1nsA1tR6yg+q37iydmk8kc54ts5wJxTPI1TpalIaPtLPrVC tfCTRQ79n6be/dJpo2All7E1XhyQfR4= X-MC-Unique: qDQ-jwI8Nome1Jr0grdh0Q-1 From: Konstantin Kostiuk To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Daniel=20P=20=2E=20Berrang=C3=A9?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Bin Meng , Stefan Weil , Yonggang Luo , Markus Armbruster , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Peter Maydell , Gerd Hoffmann , "Michael S. Tsirkin" , Thomas Huth , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Roth , Mauro Matteo Cascella , Yan Vugenfirer , Evgeny Iakovlev , Andrey Drobyshev , Xuzhou Cheng , brian.wiltse@live.com Subject: [PATCH v3 2/2] qga/win32: Use rundll for VSS installation Date: Fri, 3 Mar 2023 21:20:08 +0200 Message-Id: <20230303192008.109549-3-kkostiuk@redhat.com> In-Reply-To: <20230303192008.109549-1-kkostiuk@redhat.com> References: <20230303192008.109549-1-kkostiuk@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.1 on 10.11.54.7 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kkostiuk@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1677871274029100007 Content-Type: text/plain; charset="utf-8" The custom action uses cmd.exe to run VSS Service installation and removal which causes an interactive command shell to spawn. This shell can be used to execute any commands as a SYSTEM user. Even if call qemu-ga.exe directly the interactive command shell will be spawned as qemu-ga.exe is a console application and used by users from the console as well as a service. As VSS Service runs from DLL which contains the installer and uninstaller code, it can be run directly by rundll32.exe without any interactive command shell. Add specific entry points for rundll which is just a wrapper for COMRegister/COMUnregister functions with proper arguments. resolves: https://bugzilla.redhat.com/show_bug.cgi?id=3D2167423 fixes: CVE-2023-0664 (part 2 of 2) Signed-off-by: Konstantin Kostiuk Reviewed-by: Yan Vugenfirer Reported-by: Brian Wiltse --- qga/installer/qemu-ga.wxs | 10 +++++----- qga/vss-win32/install.cpp | 9 +++++++++ qga/vss-win32/qga-vss.def | 2 ++ 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/qga/installer/qemu-ga.wxs b/qga/installer/qemu-ga.wxs index feb629ec47..46ae9e7a13 100644 --- a/qga/installer/qemu-ga.wxs +++ b/qga/installer/qemu-ga.wxs @@ -127,22 +127,22 @@ - + diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp index b57508fbe0..68662a6dfc 100644 --- a/qga/vss-win32/install.cpp +++ b/qga/vss-win32/install.cpp @@ -357,6 +357,15 @@ out: return hr; } +STDAPI_(void) CALLBACK DLLCOMRegister(HWND, HINSTANCE, LPSTR, int) +{ + COMRegister(); +} + +STDAPI_(void) CALLBACK DLLCOMUnregister(HWND, HINSTANCE, LPSTR, int) +{ + COMUnregister(); +} static BOOL CreateRegistryKey(LPCTSTR key, LPCTSTR value, LPCTSTR data) { diff --git a/qga/vss-win32/qga-vss.def b/qga/vss-win32/qga-vss.def index 927782c31b..ee97a81427 100644 --- a/qga/vss-win32/qga-vss.def +++ b/qga/vss-win32/qga-vss.def @@ -1,6 +1,8 @@ LIBRARY "QGA-PROVIDER.DLL" EXPORTS + DLLCOMRegister + DLLCOMUnregister COMRegister PRIVATE COMUnregister PRIVATE DllCanUnloadNow PRIVATE -- 2.25.1