Glance

  1. Bug #1996188
  2. Comment #103

Comment 103 for bug 1996188

Revision history for this message
Thomas Goirand (thomas-goirand) wrote : Re: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Also, it's not clear to me (as a user) what should be the acceptable values of vmdk_allowed_types. Could someone (that has the knowledge) add in the option help text:

1/ If the default values are safe (ie: no vulnerability if ['streamOptimized', 'monolithicSparse'], therefore, safe to upgrade nova-compute and running it with vmdk_allowed_types not defined in the config file, which is what is going to happen when upgrading the Debian package).

2/ What is the exhaustive list of possible values.

3/ What value exposes Nova to the VMDK file leak vulnerability.

I've searched the net for all of these info, but couldn't find out. It is very likely that I wont be the only one asking myself these questions, so having the info directly available in the default help text for the vmdk_allowed_types would be a very important improvement. BTW, I don't think having a verbose help is a problem in the current situation.