3.3 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
26.7%
The qemu-nbd tool (shipped in the Xen hypervisor tools distribution as qemu-nbd-xen) autodetects the image format.
If a particular disk image is intended to be raw, a guest operating system administrator could write a header to the image, describing another format than original one. This could lead to a scenario in which after restart of that guest, qemu-nbd would detect the new apparent format of the image, including a specified backing file or device, which could allow the guest to read any file on the host.
qemu-nbd (qemu-nbd-xen) is not used by the toolstack software supplied with the Xen tree. However, it is built and installed, and so might be used by host administrators or by toolstacks other than libxl or xend.
If qemu-nbd is used, a malicious guest administrator may be able to read any file on the host, depending exactly how.
For Xen systems using libxl (xl) or xend (xm): if neither qemu-nbd-xen nor qemu-nbd (since qemu-nbd-xen is installed under the latter name in /usr/lib/xen/bin) is explicitly invoked by scripts or other software not supplied by the Xen project, the system is not vulnerable.
Xen systems using other toolstacks may be vulnerable if those toolstacks use qemu-nbd[-xen].
A guest administrator who runs qemu-nbd-xen by hand on a guest may be exposing themselves to this vulnerability.
Only qemu-xen-upstream is vulnerable; qemu-xen-traditional has a fix which makes this bug not apply. However, the Xen build system builds and installs both by default, in some arbitrary order, to the same filename. So which is installed and might be used is not predictable unless the qemu-xen-upstream build is entirely disabled.
Only systems with Xen 4.2 and later installed are vulnerable (by virtue of the presence of Xen) as earlier versions of Xen do not build qemu-xen-upstream at all.