Missing storage access check when configuring custom cloud-init snippets for a VM

Details

A user with the VM.Config.Cloudinit privilege could reference volumes from any storage via the cicustom property. If the user also has permissions to start the VM and guest access, they can thus read the contents of snippet volumes from any storage. An existing check blocks VM startup when the volume type for a volume referenced by cicustom is not snippets. Note that guest hookscripts and backup hookscripts are also snippet volumes.

This issue was privately reported by Geoffrey McClinsey <[email protected]>, and independently by Ibrahim AlJaafreh <[email protected]>, Project Loupe and Yuliang Xiao.

Fixed in

• qemu-server >= 9.2.11