Libvirt Security Notice: LSN-2025-0002 ====================================== Summary: External inactive snapshot of a VM results in world-readable disk images Reported on: 20251105 Published on: 20251113 Fixed on: 20251113 Reported by: Sylvain Beucler Patched by: Peter Krempa See also: CVE-2025-13193, debian bug #1120119 Description ----------- External inactive snapshots are created by invoking 'qemu-img' which creates the file. Currently qemu-img creates image with mode 644 based on default umask as libvirt doesn't set any. Impact ------ Newly created disk images are world-readable. Malicious user on the host can read newly written data in the VM. Workaround ---------- Don't create snapshots while the VM is inactive or fix the permissions after creating the snapshot. Affected product ---------------- Name: libvirt Repository: https://gitlab.com/libvirt/libvirt Branch: master Broken in: v1.0.1 Broken in: v1.0.2 Broken in: v1.0.3 Broken in: v1.0.4 Broken in: v1.0.5 Broken in: v1.0.6 Broken in: v1.1.0 Broken in: v1.1.1 Broken in: v1.1.2 Broken in: v1.1.3 Broken in: v1.1.4 Broken in: v1.2.0 Broken in: v1.2.1 Broken in: v1.2.2 Broken in: v1.2.3 Broken in: v1.2.4 Broken in: v1.2.5 Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Broken in: v1.2.11 Broken in: v1.2.12 Broken in: v1.2.13 Broken in: v1.2.14 Broken in: v1.2.15 Broken in: v1.2.16 Broken in: v1.2.17 Broken in: v1.2.18 Broken in: v1.2.19 Broken in: v1.2.20 Broken in: v1.2.21 Broken in: v1.3.0 Broken in: v1.3.1 Broken in: v1.3.2 Broken in: v1.3.3 Broken in: v1.3.4 Broken in: v1.3.5 Broken in: v2.0.0 Broken in: v2.1.0 Broken in: v2.2.0 Broken in: v2.3.0 Broken in: v2.4.0 Broken in: v2.5.0 Broken in: v3.0.0 Broken in: v3.1.0 Broken in: v3.2.0 Broken in: v3.3.0 Broken in: v3.4.0 Broken in: v3.5.0 Broken in: v3.6.0 Broken in: v3.7.0 Broken in: v3.8.0 Broken in: v3.9.0 Broken in: v3.10.0 Broken in: v4.0.0 Broken in: v4.1.0 Broken in: v4.2.0 Broken in: v4.3.0 Broken in: v4.4.0 Broken in: v4.5.0 Broken in: v4.6.0 Broken in: v4.7.0 Broken in: v4.8.0 Broken in: v4.9.0 Broken in: v4.10.0 Broken in: v5.0.0 Broken in: v5.1.0 Broken in: v5.2.0 Broken in: v5.3.0 Broken in: v5.4.0 Broken in: v5.5.0 Broken in: v5.6.0 Broken in: v5.7.0 Broken in: v5.8.0 Broken in: v5.9.0 Broken in: v5.10.0 Broken in: v6.0.0 Broken in: v6.1.0 Broken in: v6.2.0 Broken in: v6.3.0 Broken in: v6.4.0 Broken in: v6.5.0 Broken in: v6.6.0 Broken in: v6.7.0 Broken in: v6.8.0 Broken in: v6.9.0 Broken in: v6.10.0 Broken in: v7.0.0 Broken in: v7.1.0 Broken in: v7.2.0 Broken in: v7.3.0 Broken in: v7.4.0 Broken in: v7.5.0 Broken in: v7.6.0 Broken in: v7.7.0 Broken in: v7.8.0 Broken in: v7.9.0 Broken in: v7.10.0 Broken in: v8.0.0 Broken in: v8.1.0 Broken in: v8.2.0 Broken in: v8.3.0 Broken in: v8.4.0 Broken in: v8.5.0 Broken in: v8.6.0 Broken in: v8.7.0 Broken in: v8.8.0 Broken in: v8.9.0 Broken in: v8.10.0 Broken in: v9.0.0 Broken in: v9.1.0 Broken in: v9.2.0 Broken in: v9.3.0 Broken in: v9.4.0 Broken in: v9.5.0 Broken in: v9.6.0 Broken in: v9.7.0 Broken in: v9.8.0 Broken in: v9.9.0 Broken in: v9.10.0 Broken in: v10.0.0 Broken in: v10.1.0 Broken in: v10.2.0 Broken in: v10.3.0 Broken in: v10.4.0 Broken in: v10.5.0 Broken in: v10.6.0 Broken in: v10.7.0 Broken in: v10.8.0 Broken in: v10.9.0 Broken in: v10.10.0 Broken in: v11.0.0 Broken in: v11.1.0 Broken in: v11.2.0 Broken in: v11.3.0 Broken in: v11.4.0 Broken in: v11.5.0 Broken in: v11.6.0 Broken in: v11.7.0 Broken in: v11.8.0 Broken in: v11.9.0 Fixed in: v11.10.0 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Fixed by: a379327d8abcde8ac8d3e16fe5e4ba6f790d767a Branch: v1.0.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.0.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.0.3-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.0.4-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.0.5-maint Broken in: v1.0.5.1 Broken in: v1.0.5.2 Broken in: v1.0.5.3 Broken in: v1.0.5.4 Broken in: v1.0.5.5 Broken in: v1.0.5.6 Broken in: v1.0.5.7 Broken in: v1.0.5.8 Broken in: v1.0.5.9 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.0.6-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.1.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.1.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.1.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.1.3-maint Broken in: v1.1.3.1 Broken in: v1.1.3.2 Broken in: v1.1.3.3 Broken in: v1.1.3.4 Broken in: v1.1.3.5 Broken in: v1.1.3.6 Broken in: v1.1.3.7 Broken in: v1.1.3.8 Broken in: v1.1.3.9 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.1.4-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.3-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.4-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.5-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.6-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.7-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.8-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken in: v1.2.9.2 Broken in: v1.2.9.3 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.10-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.11-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.12-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.13-maint Broken in: v1.2.13.1 Broken in: v1.2.13.2 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.14-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.15-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.16-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.17-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.18-maint Broken in: v1.2.18.1 Broken in: v1.2.18.2 Broken in: v1.2.18.3 Broken in: v1.2.18.4 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.19-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.20-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.2.21-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.3-maint Broken in: v1.3.3.1 Broken in: v1.3.3.2 Broken in: v1.3.3.3 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.4-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v1.3.5-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v2.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v2.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v2.2-maint Broken in: v2.2.1 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v3.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v3.2-maint Broken in: v3.2.1 Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v3.7-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.3-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.4-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.5-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.6-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.7-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.8-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.9-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v4.10-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v5.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v5.1-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v5.1.0-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v5.2-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992 Branch: v5.3-maint Broken by: 9b5a514b31f0a092cff5402e37d06d1c31f1b992