Package "libvirt-daemon-system-systemd"

  libvirt (6.0.0-0ubuntu8.20) focal; urgency=medium

  * d/p/u/lp2059272-2-qemu-Wait-qemuProcessReconnect-threads-in-cleanup.patch:
    Remove patch. It is not possible to wait for qemuProcessReconnect()
    in cleanup: it talks to QEMU monitor, which blocks on replies from
    event loop, but it's already stopped at cleanup, delaying shutdown.

  * d/p/u/lp2059272-2-qemu-Do-not-save-XML-in-shutdown-on-init.patch:
    Instead of waiting at cleanup for threads which might be blocked
    thus would _not even reach_ the function that causes the problem,
    just skip that function if it is _actually reached_ while daemon
    shutdown is in progress. That is in the init path and would just
    run again anyway the next time libvirtd is started (LP: #2059272)

  * NOTE: This package contains the changes from 6.0.0-0ubuntu8.18 and
    6.0.0-0ubuntu8.17 in focal-proposed (with symbolic changelog entry)
    superseded by 6.0.0-0ubuntu8.19 in focal-security.

  libvirt (6.0.0-0ubuntu8.19) focal-security; urgency=medium

  * SECURITY UPDATE: off-by-one in udevListInterfacesByStatus()
    - debian/patches/CVE-2024-1441.patch: properly check count in
      src/interface/interface_backend_udev.c.
    - CVE-2024-1441
  * SECURITY UPDATE: crash in RPC library
    - debian/patches/CVE-2024-2494.patch: check values in
      src/remote/remote_daemon_dispatch.c, src/rpc/gendispatch.pl.
    - CVE-2024-2494
  * SECURITY UPDATE: null pointer deref in udevConnectListAllInterfaces()
    - debian/patches/CVE-2024-2496.patch: fix udev_device_get_sysattr_value
      return value check in src/interface/interface_backend_udev.c.
    - CVE-2024-2496
  * NOTE: This package does _not_ contain the changes from
    6.0.0-0ubuntu8.18 in focal-proposed.

 -- Marc Deslauriers <email address hidden> Fri, 12 Apr 2024 13:50:27 -0400

  libvirt (6.0.0-0ubuntu8.16) focal-security; urgency=medium

  * SECURITY UPDATE: crash via double-free memory issue
    - debian/patches/CVE-2020-25637-1.patch: gendispatch: handle empty
      flags in src/rpc/gendispatch.pl.
    - debian/patches/CVE-2020-25637-2.patch: add support for filtering
      @acls by uint params in src/remote/remote_protocol.x,
      src/rpc/gendispatch.pl.
    - debian/patches/CVE-2020-25637-3.patch: require write acl for guest
      agent in src/libxl/libxl_driver.c, src/qemu/qemu_driver.c,
      src/remote/remote_protocol.x.
    - debian/patches/CVE-2020-25637-4.patch: set ifname to NULL after
      freeing in src/qemu/qemu_agent.c.
    - CVE-2020-25637
  * SECURITY UPDATE: sVirt SELinux confinement flaw
    - debian/patches/CVE-2021-3631.patch: fix SELinux label generation
      logic in src/security/security_selinux.c.
    - CVE-2021-3631
  * SECURITY UPDATE: improper locking issue
    - debian/patches/CVE-2021-3667.patch: unlock object on ACL fail in
      src/storage/storage_driver.c.
    - CVE-2021-3667
  * SECURITY UPDATE: segmentation fault during VM shutdown
    - debian/patches/CVE-2021-3975.patch: add missing lock in
      qemuProcessHandleMonitorEOF in src/qemu/qemu_process.c.
    - CVE-2021-3975
  * SECURITY UPDATE: DoS via libxl driver
    - debian/patches/CVE-2021-4147-pre1.patch: fix domain shutdown in
      src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-1.patch: disable death events after
      receiving a shutdown event in src/libxl/libxl_domain.c,
      src/libxl/libxl_domain.h.
    - debian/patches/CVE-2021-4147-2.patch: rename libxlShutdownThreadInfo
      struct in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-3.patch: modify name of shutdown thread
      in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-4.patch: handle domain death events in a
      thread in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-5.patch: search for virDomainObj in
      event handler threads in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-6pre1.patch: avoid virHashFree by
      rearranging code in src/libxl/libxl_logger.c.
    - debian/patches/CVE-2021-4147-6.patch: protect access to libxlLogger
      files hash table in src/libxl/libxl_logger.c.
    - CVE-2021-4147
  * SECURITY UPDATE: DoS via nwfilter driver
    - debian/patches/CVE-2022-0897.patch: fix crash when counting number of
      network filters in src/nwfilter/nwfilter_driver.c.
    - CVE-2022-0897

 -- Marc Deslauriers <email address hidden> Wed, 20 Apr 2022 11:31:12 -0400

  libvirt (6.0.0-0ubuntu8.15) focal; urgency=medium

  * d/p/u/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch:
    avoid issues due to corrupted apparmor profiles (LP: #1927519)

 -- Christian Ehrhardt <email address hidden> Thu, 18 Nov 2021 10:23:11 +0100

  libvirt (6.0.0-0ubuntu8.14) focal; urgency=medium

  * Fixup backport of "util: Add phys_port_name support on virPCIGetNetName"
    to include the incorrectly removed "firstEntryName = NULL;" line, which
    caused a regression bringing up network pools. (LP: #1943481)
    - d/p/u/lp-1892132-Add-phys_port_name-support-on-virPCIGetNetName.patch

 -- Matthew Ruffell <email address hidden> Tue, 14 Sep 2021 14:00:49 +1200