From: Prasad J Pandit <p...@fedoraproject.org> Hello,
QEMU supports numerous virtualisation and emulation use cases. It offers many features to support guest's function(s). All of these use cases and features are not always security relevant. Because some maybe used in trusted environments only. Some may still be in experimental stage. While other could be very old and not used or maintained actively. Recently we received multiple security issue reports against VVFAT and VirtFS host directory sharing system. After discussing with the respective maintainers, it turned out that * VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083 VVFAT is quite old and is available for testing purposes only. Ie. It is not suitable for production environments. * VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup VirtFS implementation though better, it is most commonly used for automated testing under sand-boxed server environments, ie. no malicious party there. It is also not mature enough for cloud services. It is supported on 'Odd Fixes' basis atm. So these turned out to be issues which can be fixed as regular bugs. For security bug analysis we generally consider use cases wherein QEMU is used in conjunction with the KVM hypervisor, which enables guest to use hardware processor's virtualisation features. This patch introduces the CVE (or Security or Trust) Quotient field in the MAINTAINERS file. It tries to capture the security sensitivity pertaining to a feature or section of the QEMU's code base. It indicates whether a potential issue should be treated as a security one OR it could be fixed as a regular non-security bug. If Quotient == High, triage issues as potential security ones. if Quotient == Low, triage issues as regular non-security bugs. I have tagged each section in the MAINTAINERS file as High or Low on best guess basis. I request respective maintainers to kindly review it please. If you have any inputs/suggestions, I'd really appreciate them. Thank you. -- Prasad J Pandit (1): MAINTAINERS: introduce cve or security quotient field MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 324 insertions(+) -- 2.26.2