Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 304108 Details for
Bug 444583
CVE-2008-2004 qemu/kvm/xen: qemu block format auto-detection vulnerability
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Proposed patch for qemu from Chris Wright and Aurelien Jarno
qemu-block-format-arg.diff (text/plain), 2.95 KB, created by
Tomas Hoger
on 2008-04-29 11:35:03 UTC
(
hide
)
Description:
Proposed patch for qemu from Chris Wright and Aurelien Jarno
Filename:
MIME Type:
Creator:
Tomas Hoger
Created:
2008-04-29 11:35:03 UTC
Size:
2.95 KB
patch
obsolete
>From: Chris Wright <chrisw@redhat.com> >Subject: [PATCH] add format= to drive options > >A guest with a raw format disk can write any format header to that device. >A subsequent restart of the guest will cause qemu to interpret the format >header and could allow the guest read access to any host file. Add a >format= drive option to allow host to specify, e.g. format=raw, to give >qemu a hint to choose a specific block format driver. Originially noted >by Avi Kivity <avi@qumranet.com>. > >Signed-off-by: Chris Wright <chrisw@redhat.com> >[Aurelien Jarno: port to SVN tip for QEMU) >--- > qemu-doc.texi | 4 ++++ > vl.c | 13 +++++++++++-- > 2 files changed, 15 insertions(+), 2 deletions(-) > >diff --git a/qemu-doc.texi b/qemu-doc.texi >index 68630c0..6a7c421 100644 >--- a/qemu-doc.texi >+++ b/qemu-doc.texi >@@ -261,6 +261,10 @@ These options have the same definition as they have in @option{-hdachs}. > @var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}). > @item cache=@var{cache} > @var{cache} is "on" or "off" and allows to disable host cache to access data. >+@item format=@var{format} >+Specify which disk @var{format} will be used rather than detecting >+the format. Can be used to specifiy format=raw to avoid interpreting >+an untrusted format header. > @end table > > Instead of @option{-cdrom} you can use: >diff --git a/vl.c b/vl.c >index 78486cf..684ed70 100644 >--- a/vl.c >+++ b/vl.c >@@ -4963,6 +4963,7 @@ static int drive_init(struct drive_opt *arg, int snapshot, > int bus_id, unit_id; > int cyls, heads, secs, translation; > BlockDriverState *bdrv; >+ BlockDriver *drv = NULL; > int max_devs; > int index; > int cache; >@@ -4970,7 +4971,7 @@ static int drive_init(struct drive_opt *arg, int snapshot, > char *str = arg->opt; > char *params[] = { "bus", "unit", "if", "index", "cyls", "heads", > "secs", "trans", "media", "snapshot", "file", >- "cache", NULL }; >+ "cache", "format", NULL }; > > if (check_params(buf, sizeof(buf), params, str) < 0) { > fprintf(stderr, "qemu: unknown parameter '%s' in '%s'\n", >@@ -5138,6 +5139,14 @@ static int drive_init(struct drive_opt *arg, int snapshot, > } > } > >+ if (get_param_value(buf, sizeof(buf), "format", str)) { >+ drv = bdrv_find_format(buf); >+ if (!drv) { >+ fprintf(stderr, "qemu: '%s' invalid format\n", buf); >+ return -1; >+ } >+ } >+ > if (arg->file == NULL) > get_param_value(file, sizeof(file), "file", str); > else >@@ -5240,7 +5249,7 @@ static int drive_init(struct drive_opt *arg, int snapshot, > bdrv_flags |= BDRV_O_SNAPSHOT; > if (!cache) > bdrv_flags |= BDRV_O_DIRECT; >- if (bdrv_open(bdrv, file, bdrv_flags) < 0 || qemu_key_check(bdrv, file)) { >+ if (bdrv_open2(bdrv, file, bdrv_flags, drv) < 0 || qemu_key_check(bdrv, file)) { > fprintf(stderr, "qemu: could not open disk image %s\n", > file); > return -1;
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 444583
:
304107
| 304108