Comment 55 for bug 2071734

Revision history for this message
Balazs Gibizer (balazs-gibizer) wrote : Re: Regression VMDK/qcow arbitrary file access (CVE-2024-40767)

The attached patches seems to be not enough. I did testing based on 2023.1 and is see that the vmdk based vulnerability is still possible. It seems the format_inspector does not support the monolithicFlat, detects it as raw, and then nova calls qemu-img info on the image.

This can be reproduced via the original instruction on a system that patched with the attached 2023.1.patch . Or via the following unit test:
```
    def test_vmdk_monolithic_flat_format_detect(self):
        img = self._create_img("vmdk", 1 *units.Mi, subformat="monolithicFlat")
        self.assertEqual("vmdk", str(format_inspector.detect_file_format(img)))

```