Libvirt Security Notice: LSN-2010-0001

Ignoring main disk format when looking up disk backing stores

Lifecycle

Credits

See also

• CVE-2010-2237

Description

Prior to starting a guest, or when hotplugging or unplugging a device the libvirt SELinux, DAC and CGroups security drivers need to determine full file chain associated with a disk image. This is done by traversing backing file formats referenced in the disk headers. The code did not, however, honour the disk format recorded in disk XML configuration, when reading disk images so a raw file could be mis-identifed as another type of file.

Impact

The SELinux, DAC and CGroups code was not honouring disk formats so could be tricked into giving the VM access to files that were otherwise not permitted by its configuration. This can be done by taking what was expected to be a raw disks file and writing a qcow2 header into it.

Workaround

Do not use any raw disk images.

Affected product: libvirt

Alternative formats: [xml] [text]