Missing storage access check when configuring custom cloud-init snippets for a VM
Betroffene Pakete
qemu-server
Details
A user with the VM.Config.Cloudinit privilege could reference volumes from any storage via the cicustom property. If the user also has permissions to start the VM and guest access, they can thus read the contents of snippet volumes from any storage. An existing check blocks VM startup when the volume type for a volume referenced by cicustom is not snippets. Note that guest hookscripts and backup hookscripts are also snippet volumes.
This issue was privately reported by Geoffrey McClinsey <[email protected]>, and independently by Ibrahim AlJaafreh <[email protected]>, Project Loupe and Yuliang Xiao.
Behoben in
- qemu-server >= 9.2.11
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.