Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 7 Jan 2016 17:40:23 +0000
From: Tristan Cacqueray <tdecacqu@...hat.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2016-001] Nova host data leak through snapshot (CVE-2015-7548)

===================================================
OSSA-2016-001: Nova host data leak through snapshot
===================================================

:Date: January 07, 2016
:CVE: CVE-2015-7548


Affects
~~~~~~~
- Nova: <=2015.1.2, ==12.0.0


Description
~~~~~~~~~~~
Matthew Booth from Red Hat reported a vulnerability in Nova instance
snapshot. By overwriting the disk inside an instance with a malicious
image and requesting a snapshot, an authenticated user would be able
to read an arbitrary file from the compute host. Note that the host
file needs to be readable by the nova user to be exposed except when
using lvm for instance storage, when all files readable by root are
exposed. Only setups using libvirt to spawn instances are vulnerable.
Of these, setups which use filesystem storage, and do not set
"use_cow_images = False" in Nova configuration are not affected.
Setups which use ceph or lvm for instance storage, and setups which
use filesystem storage with "use_cow_images = False" are all affected.


Patches
~~~~~~~
- https://review.openstack.org/264819 (Kilo)
- https://review.openstack.org/264820 (Kilo)
- https://review.openstack.org/264821 (Kilo)
- https://review.openstack.org/264815 (Liberty)
- https://review.openstack.org/264816 (Liberty)
- https://review.openstack.org/264817 (Liberty)
- https://review.openstack.org/264812 (Mitaka)
- https://review.openstack.org/264813 (Mitaka)
- https://review.openstack.org/264814 (Mitaka)


Credits
~~~~~~~
- Matthew Booth from Red Hat (CVE-2015-7548)


References
~~~~~~~~~~
- https://bugs.launchpad.net/bugs/1524274
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7548


Notes
~~~~~
- This fix will be included in future 2015.1.3 (kilo) and 12.0.1
(liberty) releases.

--
Tristan Cacqueray
OpenStack Vulnerability Management Team


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ