Libvirt Security Notice: LSN-2010-0002

Ignoring backing store format when recursing into disk image backing stores

Lifecycle

Credits

See also

• CVE-2010-2238

Description

Prior to starting a guest, or when hotplugging or unplugging a device the libvirt SELinux, DAC and CGroups security drivers need to determine full file chain associated with a disk image. This is done by traversing backing file formats referenced in the disk headers. The code did not, however, honour the backing format encoded in disk image metadata, when recursing into disk image backing files so a raw file could be mis-identifed as another type of file.

Impact

The SELinux, DAC and CGroups code was not honouring backing formats so could be tricked into giving the VM access to files that were otherwise not permitted by its configuration. This can be done by taking what was expected to be a raw backing file and writing a qcow2 header into it.

Workaround

Do not use any disks with raw backing files.

Affected product: libvirt

Alternative formats: [xml] [text]