Glance

  1. Bug #1996188
  2. Comment #104

Comment 104 for bug 1996188

Revision history for this message
Arnaud Morin (arnaud-morin) wrote : Re: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Hi Thomas,

The default values ['streamOptimized', 'monolithicSparse'] are safe. Only these values are safe.

One of the *unsafe* value is: 'monolithicFlat'. This one should be discarded by the convert functions. This is what the patches are doing.

One of the VMDK (official?) documentation can be read here:
https://www.vmware.com/app/vmdk/?src=vmdk

Maybe that could be nice to have it in the config desc?