OSSA-2014-033: Cinder-volume host data leak to vm instance

OSSA-2014-033: Cinder-volume host data leak to vm instance

Date

October 02, 2014

CVE

CVE-2014-3641

Affects

  • Cinder: up to 2014.1.2

Description

Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder GlusterFS and Linux Smbfs drivers. By overwriting a volume from within an instance with a malicious qcow2 header, an authenticated user may be able to clone and attach that corrupted volume resulting in affected drivers leaking an arbitrary file from the Cinder-volume host to the virtual instance. Note that the host file must be readable by the Cinder context to be exposed. Only Cinder setups using GlusterFS volume driver configured with glusterfs_qcow2_volumes=False (which is the default) or Cinder setups using Smbfs volume driver configured with smbfs_default_volume_format=raw (which is not the default) are affected.

Credits

  • Duncan Thomas from Hewlett Packard (CVE-2014-3641)

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.