Pull Request已成功合入, 合并人@openeuler-ci-bot
（感谢 hanzhibian 的贡献）
变更摘要
本 PR 修复 libvirt 中 virNodeGetFreePages 的 RPC 处理器 remoteDispatchNodeGetFreePages（src/remote/remote_daemon_dispatch.c）存在的整数溢出漏洞（CVE-2026-18917）。原实现对 args->pages.pages_len 与 args->cellCount 相乘后再与 REMOTE_NODE_MAX_CELLS 比较，攻击者可构造极值使乘法结果溢出从而绕过大小检查，导致分配过小的缓冲区并触发堆溢出。本改动在乘法前使用 VIR_INT_MULTIPLY_OVERFLOW 检测溢出，并在溢出或结果超限时直接报错返回，同时优化了错误提示信息。
主要改动
- 新增整数溢出检测：将原先仅判断乘积是否大于
REMOTE_NODE_MAX_CELLS的条件，改为先通过VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount)检测乘法溢出，杜绝利用溢出绕过大小校验的可能。 - 保留结果上限校验：在溢出检测通过后，仍校验
args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS，确保分配缓冲区的大小不超过上限。 - 完善错误信息：更新报错文案为
"npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"，通过%1$u输出REMOTE_NODE_MAX_CELLS的实际数值，便于定位问题，同时移除原/* Allocate return buffer. */注释。
Welcome To openEuler Community
Hey @hanzhibian , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. You can self-configure the PR merge rules for this repository. For more details, please refer to Here.
Contact Guide
If you have any questions, please contact the SIG: Virt ,
and any of the maintainers: @Chuan-Zheng, @RootWB, @cellfaint, @flyking001, @imxcc, @kevinzhu1 ,
and any of the committers: @eillon, @huang987246510, @mdsc, @yebiaoxiang, @zhangliang5 .
门禁正在运行， 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决，可参考门禁指导手册
门禁入口及编码规范检查: multiarch/openeuler/trigger/libvirt/113/console
| Check Name | Build Result | 详情 | Build Details | |
|---|---|---|---|---|
| check_sca | ⚠WARNING | • SCA检查发现未确认的开源组件问题，请查看报告: https://www.openlibing.com/apps/personalScandTaskInfor/person/37388b5c-d28c-4526-a93d-f4c69e132f30?projectId=300024&codeHostingPlatformFlag=gitcode | #113 | |
| check_code | ✅SUCCESS | |||
| check_package_license | ✅SUCCESS | |||
| x86_64 | check_build | ✅SUCCESS | #104 | |
| aarch64 | check_build | ✅SUCCESS | #113 | |
/check-cla
/check-cla
门禁正在运行， 您可以通过以下链接查看实时门禁检查结果.
若您对门禁结果含义不清晰或者遇到问题不知如何解决，可参考门禁指导手册
门禁入口及编码规范检查: multiarch/openeuler/trigger/libvirt/128/console
| Check Name | Build Result | 详情 | Build Details | |
|---|---|---|---|---|
| check_sca | ⚠WARNING | • SCA检查发现未确认的开源组件问题，请查看报告: https://www.openlibing.com/apps/personalScandTaskInfor/person/5c603e3d-8de4-4095-940b-a7316582da39?projectId=300024&codeHostingPlatformFlag=gitcode | #128 | |
| check_code | ✅SUCCESS | |||
| check_package_license | ✅SUCCESS | |||
| x86_64 | check_build | ✅SUCCESS | #119 | |
| aarch64 | check_build | ✅SUCCESS | #128 | |
一、漏洞信息
漏洞编号：CVE-2026-18917
漏洞归属组件：libvirt
漏洞归属的版本：6.2.0,9.10.0
CVSS评分：
BaseScore：7.8 High
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon s memory, potentially leading to a denial of service or local privilege escalation.
漏洞公开时间：2026-08-20 18:16:40
漏洞创建时间：2026-08-20 20:07:14
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-18917
更多参考(点击展开)
漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：
详情(点击展开)
二、漏洞分析结构反馈
影响性分析说明：
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon s memory, potentially leading to a denial of service or local privilege escalation.
openEuler评分：
7.8
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响)：
1.master(9.10.0):受影响
2.openEuler-20.03-LTS-SP4(6.2.0):受影响
3.openEuler-22.03-LTS-SP4(6.2.0):受影响
4.openEuler-24.03-LTS-Next(9.10.0):受影响
5.openEuler-24.03-LTS-SP1(9.10.0):受影响
6.openEuler-24.03-LTS-SP3(9.10.0):受影响
7.openEuler-24.03-LTS-SP4(9.10.0):受影响
修复是否涉及abi变化(是/否)：
1.master(9.10.0):否
2.openEuler-20.03-LTS-SP4(6.2.0):否
3.openEuler-22.03-LTS-SP4(6.2.0):否
4.openEuler-24.03-LTS-Next(9.10.0):否
5.openEuler-24.03-LTS-SP1(9.10.0):否
6.openEuler-24.03-LTS-SP3(9.10.0):否
7.openEuler-24.03-LTS-SP4(9.10.0):否
原因说明：
1.master(9.10.0):正常修复
2.openEuler-20.03-LTS-SP4(6.2.0):正常修复
3.openEuler-22.03-LTS-SP4(6.2.0):正常修复
4.openEuler-24.03-LTS-Next(9.10.0):正常修复
5.openEuler-24.03-LTS-SP1(9.10.0):正常修复
6.openEuler-24.03-LTS-SP3(9.10.0):正常修复
7.openEuler-24.03-LTS-SP4(9.10.0):正常修复