From: Prasad J Pandit <pjp@fedoraproject.org>

Hello,

QEMU supports numerous virtualisation and emulation use cases.
It offers many features to support guest's function(s).

All of these use cases and features are not always security relevant.
Because some maybe used in trusted environments only. Some may still
be in experimental stage. While other could be very old and not
used or maintained actively.

Recently we received multiple security issue reports against VVFAT
and VirtFS host directory sharing system. After discussing with the
respective maintainers, it turned out that

* VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083
  VVFAT is quite old and is available for testing purposes only.
  Ie. It is not suitable for production environments.

* VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup
  VirtFS implementation though better, it is most commonly used for
  automated testing under sand-boxed server environments, ie. no
  malicious party there. It is also not mature enough for cloud services.
  It is supported on 'Odd Fixes' basis atm.

So these turned out to be issues which can be fixed as regular bugs.

For security bug analysis we generally consider use cases wherein
QEMU is used in conjunction with the KVM hypervisor, which enables
guest to use hardware processor's virtualisation features.

This patch introduces the CVE (or Security or Trust) Quotient field
in the MAINTAINERS file. It tries to capture the security sensitivity
pertaining to a feature or section of the QEMU's code base.

It indicates whether a potential issue should be treated as a security
one OR it could be fixed as a regular non-security bug.

    If Quotient == High, triage issues as potential security ones.
    if Quotient == Low,  triage issues as regular non-security bugs.

I have tagged each section in the MAINTAINERS file as High or Low on best
guess basis. I request respective maintainers to kindly review it please.

If you have any inputs/suggestions, I'd really appreciate them.

Thank you.
--
Prasad J Pandit (1):
  MAINTAINERS: introduce cve or security quotient field

 MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 324 insertions(+)

--
2.26.2

On Tue, Jul 14, 2020 at 02:06:30PM +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> Hello,
> 
> QEMU supports numerous virtualisation and emulation use cases.
> It offers many features to support guest's function(s).
> 
> All of these use cases and features are not always security relevant.
> Because some maybe used in trusted environments only. Some may still
> be in experimental stage. While other could be very old and not
> used or maintained actively.
> 
> Recently we received multiple security issue reports against VVFAT
> and VirtFS host directory sharing system. After discussing with the
> respective maintainers, it turned out that
> 
> * VVFAT -> https://bugs.launchpad.net/qemu/+bug/1883083
>   VVFAT is quite old and is available for testing purposes only.
>   Ie. It is not suitable for production environments.
> 
> * VirtFS/9pfs -> https://wiki.qemu.org/Documentation/9psetup
>   VirtFS implementation though better, it is most commonly used for
>   automated testing under sand-boxed server environments, ie. no
>   malicious party there. It is also not mature enough for cloud services.
>   It is supported on 'Odd Fixes' basis atm.
> 
> So these turned out to be issues which can be fixed as regular bugs.
> 
> For security bug analysis we generally consider use cases wherein
> QEMU is used in conjunction with the KVM hypervisor, which enables
> guest to use hardware processor's virtualisation features.
> 
> This patch introduces the CVE (or Security or Trust) Quotient field
> in the MAINTAINERS file. It tries to capture the security sensitivity
> pertaining to a feature or section of the QEMU's code base.
> 
> It indicates whether a potential issue should be treated as a security
> one OR it could be fixed as a regular non-security bug.
> 
>     If Quotient == High, triage issues as potential security ones.
>     if Quotient == Low,  triage issues as regular non-security bugs.
> 
> I have tagged each section in the MAINTAINERS file as High or Low on best
> guess basis. I request respective maintainers to kindly review it please.
> 
> If you have any inputs/suggestions, I'd really appreciate them.
> 
> Thank you.

So this attempts to specify a security aspect of specific files.
Which works for some use-cases (e.g. devices) but not others
(common utility functions).

I'd like to propose add a flag that limits QEMU to a secured subset
of functionality at runtime instead.
Then we can just tell security researchers "reproduce this with
-security=high or it's not a security issue".


> --
> Prasad J Pandit (1):
>   MAINTAINERS: introduce cve or security quotient field
> 
>  MAINTAINERS | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 324 insertions(+)
> 
> --
> 2.26.2