Skip to content

fix(libvirt): CVE-2025-13193 set proper umask for external snapshots#24

Open
deepin-ci-robot wants to merge 1 commit into
masterfrom
fix/CVE-2025-13193-multi
Open

fix(libvirt): CVE-2025-13193 set proper umask for external snapshots#24
deepin-ci-robot wants to merge 1 commit into
masterfrom
fix/CVE-2025-13193-multi

Conversation

@deepin-ci-robot

@deepin-ci-robot deepin-ci-robot commented May 26, 2026

Copy link
Copy Markdown
Contributor

Summary

Fix CVE-2025-13193: External inactive snapshots for shut-down VMs were incorrectly created as world-readable (mode 644), allowing unprivileged users to inspect the guest OS contents.

Changes

  • Set umask to 0077 before calling qemu-img create to ensure new snapshot files are only readable by the owner (mode 600).

References

Testing

  • All quilt patches apply cleanly
  • Changelog format validated

Generated-By: glm-5.1
Co-Authored-By: hudeng hudeng@deepin.org

@deepin-ci-robot @hudeng-go
fix(libvirt): CVE-2025-13193 set proper umask for external snapshots
a8541c0 
External inactive snapshots for shut-down VMs were incorrectly created
as world-readable (mode 644), allowing unprivileged users to inspect
the guest OS contents.

Set umask to 0077 before calling qemu-img create to ensure new files
are only readable by the owner (mode 600).

Upstream: https://gitlab.com/libvirt/libvirt/-/commit/a379327d8a
Generated-By: glm-5.1
Co-Authored-By: hudeng <hudeng@deepin.org>
@deepin-ci-robot

deepin-ci-robot commented May 26, 2026

Copy link
Copy Markdown
Contributor Author

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign utsweetyfish for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions

github-actions Bot commented May 26, 2026

Copy link
Copy Markdown

TAG Bot

TAG: 10.7.0+really9.10.0-1deepin17
EXISTED: no
DISTRIBUTION: unstable

@hudeng-go

hudeng-go commented May 27, 2026

Copy link
Copy Markdown
Contributor

/integrate

@deepin-community-ci-bot deepin-community-ci-bot Bot mentioned this pull request May 27, 2026
Open
@github-actions

github-actions Bot commented May 27, 2026

Copy link
Copy Markdown

AutoIntegrationPr Bot
auto integrate with pr url: deepin-community/Repository-Integration#4082
PrNumber: 4082
PrBranch: auto-integration-26485423727

@deepin-community-ci-bot

deepin-community-ci-bot Bot commented Jun 16, 2026

Copy link
Copy Markdown

TAG Bot

New tag: 10.7.0+really9.10.0-1deepin20
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #27

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BLumia BLumia Awaiting requested review from BLumia

@justforlxz justforlxz Awaiting requested review from justforlxz

Assignees

No one assigned

Labels

cve generated-by-ai

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@deepin-ci-robot @hudeng-go