add format= to drive options (CVE-2008-2004)

It is possible for a guest with a raw formatted disk image to write a
header to that disk image describing another format (such as qcow2).
Stopping and subsequent restart of the guest will cause qemu to detect
that format, and could allow the guest to read any host file if qemu is
sufficiently privileged (typical in virt environments).

The patch defaults to existing behaviour (probing based on file contents),
so it still requires the mgmt app (e.g. libvirt xml) to pass a new
"format=raw" parameter for raw disk images.

Originally noted by Avi Kivity, patch from Chris Wright.

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4277 c046a42c-6fe2-441c-8c8c-71466251a162

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 45c89ce26bcc2b51ad95f243a21c6c3300e3f5d1..1f409f47f4b5e85c122ecfbe52cca0f4be0e0da3 100644 (file)
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -261,6 +261,10 @@ These options have the same definition as they have in @option{-hdachs}.
 @var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
 @item cache=@var{cache}
 @var{cache} is "on" or "off" and allows to disable host cache to access data.
+@item format=@var{format}
+Specify which disk @var{format} will be used rather than detecting
+the format.  Can be used to specifiy format=raw to avoid interpreting
+an untrusted format header.
 @end table
 
 Instead of @option{-cdrom} you can use:

diff --git a/vl.c b/vl.c
index c30a87faa760edeec57fe724fa623b10bbfc629f..6daa77707f04ca46cca55f28f84571013165efe9 100644 (file)
--- a/vl.c
+++ b/vl.c
@@ -4961,6 +4961,7 @@ static int drive_init(struct drive_opt *arg, int snapshot,
     int bus_id, unit_id;
     int cyls, heads, secs, translation;
     BlockDriverState *bdrv;
+    BlockDriver *drv = NULL;
     int max_devs;
     int index;
     int cache;
@@ -4968,7 +4969,7 @@ static int drive_init(struct drive_opt *arg, int snapshot,
     char *str = arg->opt;
     char *params[] = { "bus", "unit", "if", "index", "cyls", "heads",
                        "secs", "trans", "media", "snapshot", "file",
-                       "cache", NULL };
+                       "cache", "format", NULL };
 
     if (check_params(buf, sizeof(buf), params, str) < 0) {
          fprintf(stderr, "qemu: unknown parameter '%s' in '%s'\n",
@@ -5136,6 +5137,14 @@ static int drive_init(struct drive_opt *arg, int snapshot,
         }
     }
 
+    if (get_param_value(buf, sizeof(buf), "format", str)) {
+        drv = bdrv_find_format(buf);
+        if (!drv) {
+            fprintf(stderr, "qemu: '%s' invalid format\n", buf);
+            return -1;
+        }
+    }
+
     if (arg->file == NULL)
         get_param_value(file, sizeof(file), "file", str);
     else
@@ -5238,7 +5247,7 @@ static int drive_init(struct drive_opt *arg, int snapshot,
         bdrv_flags |= BDRV_O_SNAPSHOT;
     if (!cache)
         bdrv_flags |= BDRV_O_DIRECT;
-    if (bdrv_open(bdrv, file, bdrv_flags) < 0 || qemu_key_check(bdrv, file)) {
+    if (bdrv_open2(bdrv, file, bdrv_flags, drv) < 0 || qemu_key_check(bdrv, file)) {
         fprintf(stderr, "qemu: could not open disk image %s\n",
                         file);
         return -1;