Shell command injection via volume name

Details

Missing validation and escaping of the requested volume name when allocating a volume on a ZFS-over-iSCSI storage allowed an attacker with Datastore.AllocateSpace privileges on such a storage to inject arbitrary arguments into a command executed as root on the iSCSI target host.

Missing validation and escaping of the volume name on directory-based storages allowed an attacker with Datastore.AllocateSpace and VM.Migrate privileges to inject arbitrary commands into a command invocation on the migration target host.

These issues were found internally.

Fixed in

• libpve-guest-common-perl >= 6.0.7

• libpve-storage-perl >= 9.1.15

• qemu-server >= 9.2.15