[AutoPR- Security] Patch libvirt for CVE-2025-13193 [MEDIUM] (#15149)

Author: azurelinux-security

SPECS/libvirt/CVE-2025-13193.patch

@@ -0,0 +1,38 @@
+From b3c22760e37dbbd8c3be2368c62dc34289faff42 Mon Sep 17 00:00:00 2001
+From: Peter Krempa <[email protected]>
+Date: Wed, 12 Nov 2025 17:52:05 +0100
+Subject: [PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating
+ external inactive snapshots
+
+External inactive snapshots are created by invoking 'qemu-img' which
+creates the file. Currently qemu-img creates image with mode 644 based
+on default umask as libvirt doesn't set any.
+
+Having a world-readable image is obviously wrong so set the umask to
+077 to have the file readable only by the owner.
+
+Resolves: https://bugs.debian.org/1120119
+Signed-off-by: Peter Krempa <[email protected]>
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a.patch
+---
+ src/qemu/qemu_snapshot.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
+index 73ff533..9819448 100644
+--- a/src/qemu/qemu_snapshot.c
++++ b/src/qemu/qemu_snapshot.c
+@@ -233,6 +233,9 @@ qemuSnapshotCreateQcow2Files(virQEMUDriver *driver,
+                                          NULL)))
+             return -1;
+ 
++        /* ensure that new files are only readable by the user */
++        virCommandSetUmask(cmd, 0077);
++
+         /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */
+         virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=",
+                           virStorageFileFormatTypeToString(defdisk->src->format));
+-- 
+2.45.4
+

SPECS/libvirt/libvirt.spec

@@ -185,7 +185,7 @@
 Summary:        Library providing a simple virtualization API
 Name:           libvirt
 Version:        10.0.0
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -199,6 +199,7 @@ Patch0:         libvirt-conf.patch
 Patch1:         CVE-2024-1441.patch
 Patch2:         CVE-2024-2494.patch
 Patch3:         CVE-2024-4418.patch
+Patch4:         CVE-2025-13193.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -2189,6 +2190,9 @@ exit 0
 %endif
 
 %changelog
+* Fri Nov 21 2025 Azure Linux Security Servicing Account <[email protected]> - 10.0.0-6
+- Patch for CVE-2025-13193
+
 * Thu May 15 2025 Aninda Pradhan <[email protected]> - 10.0.0-5
 - Fixes CVE-2024-4418 with an upstream patch