Incomplete privilege checks for outgoing remote migration

Details

Outgoing remote migrations were previously allowed with just VM.Migrate on the source side. While a regular, intra-cluster migration does not, a remote migration effectively gives access to the guest's configuration, and potentially allows removing the guest on the source side. Corresponding additional privilege checks were added.

This issue was reported privately by Project Loupe, and additionally by Vítor Fonte <[email protected]>.

Fixed in

• qemu-server >= 9.2.13

• pve-container >= 6.1.15