Libvirt Security Notice: LSN-2010-0003

Not setting user defined backing store format when creating new image


Reported on: 20100615
Published on: 20100712
Fixed on: 20100719


Reported by: Daniel Berrange
Patched by: Daniel Berrange

See also


When creating new qcow2 disk images the storage driver was not setting the backing file format in the header metadata. When attempting a boot a VM from such an image later on, the virtualization driver would need to probe to determine the backing file format. It would also not report the correct format for existing files being queried.


If a raw disk image which was originally set as a backing file for a qcow2 image had its contents replaced with a qcow2 format image, the virtualization driver could be tricked to granting access to inappropriate files.


Do not use raw files as disk iamges

Affected product: libvirt

Branch master
Broken in: v0.4.1
Broken in: v0.4.2
Broken in: v0.4.4
Broken in: v0.4.6
Broken in: v0.5.0
Broken in: v0.5.1
Broken in: v0.6.0
Broken in: v0.6.1
Broken in: v0.6.2
Broken in: v0.6.3
Broken in: v0.6.4
Broken in: v0.6.5
Broken in: v0.7.0
Broken in: v0.7.1
Broken in: v0.7.2
Broken in: v0.7.3
Broken in: v0.7.4
Broken in: v0.7.5
Broken in: v0.7.6
Broken in: v0.7.7
Broken in: v0.8.0
Broken in: v0.8.1
Broken in: v0.8.2
Fixed in: v0.8.3
Broken by: e266ded2f6d81e42ecb48089bcb662eb4fc2f58e
Fixed by: 187da82fea598aa017bdfc82a1622f9c8d75ee74

Alternative formats: [xml] [text]