The attached patches seems to be not enough. I did testing based on 2023.1 and is see that the vmdk based vulnerability is still possible. It seems the format_inspector does not support the monolithicFlat, detects it as raw, and then nova calls qemu-img info on the image.
This can be reproduced via the original instruction on a system that patched with the attached 2023.1.patch . Or via the following unit test:
```
def test_vmdk_monolithic_flat_format_detect(self):
img = self._create_img("vmdk", 1 *units.Mi, subformat="monolithicFlat") self.assertEqual("vmdk", str(format_inspector.detect_file_format(img)))
The attached patches seems to be not enough. I did testing based on 2023.1 and is see that the vmdk based vulnerability is still possible. It seems the format_inspector does not support the monolithicFlat, detects it as raw, and then nova calls qemu-img info on the image.
This can be reproduced via the original instruction on a system that patched with the attached 2023.1.patch . Or via the following unit test: monolithic_ flat_format_ detect( self): img("vmdk" , 1 *units.Mi, subformat= "monolithicFlat ")
self.assertEqu al("vmdk" , str(format_ inspector. detect_ file_format( img)))
```
def test_vmdk_
img = self._create_
```