-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of qcow2 backing file paths. The patches show both drivers modified their _qemu_img_info methods to add validation (via _validate_volume), indicating these were the entry points for processing volume headers. These functions would appear in stack traces when handling volume clone/attach operations with malicious qcow2 images. The GlusterFS driver's default raw format handling and Smbfs driver's optional raw format configuration were vulnerable paths.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cinder | pip | < 2014.1.3 | 2014.1.3 |