REDHAT-BUG-2513066: Medium severity libvirt vulnerability
A file permission vulnerability was found in libvirt's storage volume clone/convert path in src/storage/storageutil.c. The virStorageBackendCreateExecCommand() function ran qemu-img with umask 0 on non-NETFS local storage paths, causing newly created volume images to be world-readable (mode 0644) during the copy operation. libvirt only tightened the file permissions via chmod() after qemu-img completed, creating a window where the full guest disk contents could be read by any local user.
This is the same class of issue as CVE-2025-13193. A local attacker could exploit this race window to read sensitive guest disk contents, resulting in information disclosure.
The fix moves the virCommandSetUmask() call to apply unconditionally to all code paths, ensuring qemu-img creates files with restrictive permissions from the outset.
Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply virCommandSetUmask() unconditionally to all code paths so qemu-img does not run with umask 0 on non-NETFS local storage paths; ensure qemu-img creates volume image files with restrictive permissions from the outset (instead of relying on a later chmod() after the copy finishes).
libvirt (storage_util.c: virStorageBackendCreateExecCommand/qemu-img invocation) umask applied to qemu-img-created files (via virCommandSetUmask()) = apply unconditionally (no umask 0 for non-NETFS local storage paths) - Compensating control
If you cannot immediately apply the upstream change, restrict local access to libvirt storage volume clone/convert operations and the storage path so untrusted local users cannot read newly created volume images during the copy window.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2513066?
The severity of REDHAT-BUG-2513066 is classified as medium with a score of 4.
How do I fix REDHAT-BUG-2513066?
To fix REDHAT-BUG-2513066, update libvirt to the latest version where the issue has been addressed.
What components are affected by REDHAT-BUG-2513066?
REDHAT-BUG-2513066 affects the libvirt storage volume clone/convert functionality.
What are the risks associated with REDHAT-BUG-2513066?
The risk associated with REDHAT-BUG-2513066 is that it allows newly created volume images to become world-readable, potentially exposing sensitive data.
In which file is the vulnerability found for REDHAT-BUG-2513066?
The vulnerability for REDHAT-BUG-2513066 is found in src/storage/storage_util.c within the libvirt codebase.