aboutsummaryrefslogtreecommitdiff
path: root/qemu-doc.texi
diff options
context:
space:
mode:
authoraurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162>2008-04-28 20:26:45 +0000
committeraurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162>2008-04-28 20:26:45 +0000
commit1e72d3b7ad9108fec5cb90d38ddfd00bdf498db2 (patch)
tree46c01367daf00edfbc695788d4ab8c8037dc91ec /qemu-doc.texi
parent5b2575789bf30630d6f1c185ddb239945df96fa5 (diff)
add format= to drive options (CVE-2008-2004)
It is possible for a guest with a raw formatted disk image to write a header to that disk image describing another format (such as qcow2). Stopping and subsequent restart of the guest will cause qemu to detect that format, and could allow the guest to read any host file if qemu is sufficiently privileged (typical in virt environments). The patch defaults to existing behaviour (probing based on file contents), so it still requires the mgmt app (e.g. libvirt xml) to pass a new "format=raw" parameter for raw disk images. Originally noted by Avi Kivity, patch from Chris Wright. git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4277 c046a42c-6fe2-441c-8c8c-71466251a162
Diffstat (limited to 'qemu-doc.texi')
-rw-r--r--qemu-doc.texi4
1 files changed, 4 insertions, 0 deletions
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 45c89ce26b..1f409f47f4 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -261,6 +261,10 @@ These options have the same definition as they have in @option{-hdachs}.
@var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
@item cache=@var{cache}
@var{cache} is "on" or "off" and allows to disable host cache to access data.
+@item format=@var{format}
+Specify which disk @var{format} will be used rather than detecting
+the format. Can be used to specifiy format=raw to avoid interpreting
+an untrusted format header.
@end table
Instead of @option{-cdrom} you can use: