Comment 213 for bug 2059809

Revision history for this message
Dan Smith (danms) wrote : Re: Arbitrary file access through QCOW2 external data file (CVE-2024-32498)

This is a new unified glance patch which adds QED detection to the format_inspector. Note that it doesn't do anything other than detect it, and the safety check always returns false since we don't support it anywhere. That should avoid us thinking it's a raw file and passing it to qemu-img unsafely.

Note that this patch also includes two new ones that I've had locally but didn't previously include in the glance patch. One is the detect_file_format() routine that nova and cinder are using, which we might as well include in glance now anyway. The other is an update to the glance/tools/test_format_inspector.py standalone test tool. You can use that to show that QED is detected and fails the safety check:

$ python glance/tools/test_format_inspector -f qed -v -i test.qed

Felix, if nova is susceptible to this then I'll work on adding this to the nova patches as well, but if it's only cinder or something we might want to hold off instead of complicating further. Awaiting your reply.