Incomplete privilege checks for cloudinit config changes
Affected packages
qemu-server
Details
An attacker with VM.Config.Network privileges on a VM could change cloud-init settings relating to authentication within the VM, which would otherwise require the VM.Config.Cloudinit privilege.
Note: normally, these settings only have an effect inside the VM on first boot, or after changing the instance-id.
This issue was privately reported by Project Loupe.
Fixed in
- qemu-server >= 9.2.11
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.