This vulnerability arises from libvirt's use of the qemu-img utility during storage volume clone or convert operations, where newly created volume images are temporarily assigned world-readable permissions. This incorrect permission assignment (CWE-732) allows any local user on the host system to access the full guest disk contents, leading to potential sensitive information disclosure. The issue is due to qemu-img running with overly permissive file creation settings. Red Hat has published an advisory but currently does not provide an official fix or effective mitigation that meets their standards.

The vulnerability allows local users with low privileges to read sensitive data from guest virtual machine disk images during clone or convert operations. This can lead to confidentiality breaches of guest VM contents. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Red Hat currently does not offer an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Until a fix is available, limiting local user access to the host system and avoiding untrusted users performing clone or convert operations may reduce risk. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.