Libvirt Security Notice: LSN-2010-0003
        ======================================

       Summary: Not setting user defined backing store format when
                creating new image
   Reported on: 20100615
  Published on: 20100712
      Fixed on: 20100719
   Reported by: Daniel Berrange <berrange@redhat.com>
    Patched by: Daniel Berrange <berrange@redhat.com>
      See also: CVE-2010-2239

Description
-----------

When creating new qcow2 disk images the storage driver was not
setting the backing file format in the header metadata. When
attempting a boot a VM from such an image later on, the
virtualization driver would need to probe to determine the backing
file format. It would also not report the correct format for
existing files being queried.

Impact
------

If a raw disk image which was originally set as a backing file for a
qcow2 image had its contents replaced with a qcow2 format image, the
virtualization driver could be tricked to granting access to
inappropriate files.

Workaround
----------

Do not use raw files as disk iamges

Affected product
----------------

        Name: libvirt
  Repository: https://gitlab.com/libvirt/libvirt

      Branch: master
   Broken in: v0.4.1
   Broken in: v0.4.2
   Broken in: v0.4.4
   Broken in: v0.4.6
   Broken in: v0.5.0
   Broken in: v0.5.1
   Broken in: v0.6.0
   Broken in: v0.6.1
   Broken in: v0.6.2
   Broken in: v0.6.3
   Broken in: v0.6.4
   Broken in: v0.6.5
   Broken in: v0.7.0
   Broken in: v0.7.1
   Broken in: v0.7.2
   Broken in: v0.7.3
   Broken in: v0.7.4
   Broken in: v0.7.5
   Broken in: v0.7.6
   Broken in: v0.7.7
   Broken in: v0.8.0
   Broken in: v0.8.1
   Broken in: v0.8.2
    Fixed in: v0.8.3
   Broken by: e266ded2f6d81e42ecb48089bcb662eb4fc2f58e
    Fixed by: 187da82fea598aa017bdfc82a1622f9c8d75ee74