OSSA-2016-007: Nova host data leak through resize/migration

OSSA-2016-007: Nova host data leak through resize/migration

Date

March 08, 2016

CVE

CVE-2016-2140

Affects

  • Nova: <=2015.1.3, >=12.0.0 <=12.0.2

Description

Matthew Booth from Red Hat reported a vulnerability in Nova instance resize/migration. By overwriting an ephemeral or root disk with a malicious image before requesting a resize, an authenticated user may be able to read arbitrary files from the compute host. Only setups using libvirt driver with raw storage and setting “use_cow_images = False” (not default) are affected.

Errata

The former fix did not take into account the usage of non-disk-image backends and caused a regression for this use-case. This update provides an additional fix for that issue. Moreover, the kilo backport caused a regression in live migration where the disk info file is JSON encoded. This second update provides an additional fix for stable/kilo.

Credits

  • Matthew Booth from Red Hat (CVE-2016-2140)

Notes

  • This fix will be included in future 2015.1.4 (kilo) and 12.0.3 (liberty) releases.

OSSA History

  • 2016-03-30 - Errata 2

  • 2016-03-09 - Errata 1

  • 2016-03-08 - Original Version

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.