Libvirt Security Notice: LSN-2010-0003

Not setting user defined backing store format when creating new image

Lifecycle

Credits

See also

• CVE-2010-2239

Description

When creating new qcow2 disk images the storage driver was not setting the backing file format in the header metadata. When attempting a boot a VM from such an image later on, the virtualization driver would need to probe to determine the backing file format. It would also not report the correct format for existing files being queried.

Impact

If a raw disk image which was originally set as a backing file for a qcow2 image had its contents replaced with a qcow2 format image, the virtualization driver could be tricked to granting access to inappropriate files.

Workaround

Do not use raw files as disk iamges

Affected product: libvirt

Alternative formats: [xml] [text]