From: HE WEI（ギカク） <[email protected]> On the local (non-NETFS) path virStorageBackendCreateExecCommand() ran qemu-img with umask 0, so the destination image was created world-readable (0644) and the full source disk was written into it before libvirt tightened the mode with a later chmod(). This is the same class as CVE-2025-13193; apply the same fix by setting a 0077 umask so qemu-img creates the file private from the start.
Fixes: CVE-2026-63623 Reported-by: HE WEI（ギカク） <[email protected]> Signed-off-by: HE WEI（ギカク） <[email protected]> [DB: merged the two virCommandSetUmask to one] Signed-off-by: Daniel P. Berrangé <[email protected]> --- src/storage/storage_util.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/storage/storage_util.c b/src/storage/storage_util.c index 78dc9f9f1c..9e6b266842 100644 --- a/src/storage/storage_util.c +++ b/src/storage/storage_util.c @@ -464,6 +464,7 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, bool filecreated = false; int ret = -1; + virCommandSetUmask(cmd, S_IRWXUGO ^ mode); if ((def->type == VIR_STORAGE_POOL_NETFS) && (((geteuid() == 0) && (vol->target.perms->uid != (uid_t)-1) @@ -473,7 +474,6 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, virCommandSetUID(cmd, vol->target.perms->uid); virCommandSetGID(cmd, vol->target.perms->gid); - virCommandSetUmask(cmd, S_IRWXUGO ^ mode); if (virCommandRun(cmd, NULL) == 0) { /* command was successfully run, check if the file was created */ @@ -505,7 +505,6 @@ virStorageBackendCreateExecCommand(virStoragePoolObj *pool, /* don't change uid/gid/mode if we retry */ virCommandSetUID(cmd, -1); virCommandSetGID(cmd, -1); - virCommandSetUmask(cmd, 0); if (virCommandRun(cmd, NULL) < 0) goto cleanup; -- 2.55.0
