Commit fd2cee4c2e for qemu.org

commit fd2cee4c2e648e18a30fddc66db379f1200019e7
Author: Eric Blake <eblake@redhat.com>
Date:   Tue Nov 10 09:53:57 2026 -0600

    docs: Mention security considerations for NBD

    Document a policy that NBD connections should strongly consider using
    TLS and x509 certificates to filter out unwanted clients.  If a
    malicious server or client can trigger a QEMU assertion failure on a
    plaintext connection, but can trivially have risk mitigated by
    enabling TLS to weed out unknown partners (so that a full-on attack of
    QEMU would first require chaining some other attack to convince a
    "trusted" client to break protocol in the first place), then that
    reduces the CVSS-BE score of the QEMU bug. In turn, our policy already
    states that low severity scores can be fixed without an embargo.

    Signed-off-by: Eric Blake <eblake@redhat.com>
    Message-ID: <20261110155356.1520433-7-eblake@redhat.com>
    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

diff --git a/docs/system/security.rst b/docs/system/security.rst
index 92a5d87503..c0254fef11 100644
--- a/docs/system/security.rst
+++ b/docs/system/security.rst
@@ -320,3 +320,26 @@ encryption and authorization control policy on client connections.
 In summary, the monitor console is considered a privileged control interface to
 QEMU and as such should only be made accessible to a trusted management
 application or user.
+
+Block device network protocols (NBD, NFS, etc.)
+'''''''''''''''''''''''''''''''''''''''''''''''
+
+When using QEMU to access remote storage over a network (such as QEMU
+acting as an NBD or NFS client) or to provide remote storage access
+(such as QEMU acting as an NBD server), it is important to realize
+that an unencrypted connection can allow any external process a
+potential attack vector via the network port. When possible, QEMU
+should be configured to require TLS to prevent a man-in-the-middle
+attack, as well as use x509 client certificates with the
+tls-creds-x509 object set with 'verify-peer=on' to check that the peer
+is allowed to connect. It may also be worth using 'tls-authz' to
+filter which certificates are allowed if the CA issues certs more
+broadly.
+
+Proper hardening of network connections cannot prevent a client from
+violating protocol, but does increase the complexity of an attack,
+because a malicious actor must first find a way to convince an
+authenticated client to send the bytes that will trigger any QEMU
+misbehavior.  Use of a hardened connection is therefore an
+environmental factor used in determining the risk and severity of a
+network-triggered bug.