=================================================== OSSA-2016-001: Nova host data leak through snapshot =================================================== :Date: January 07, 2016 :CVE: CVE-2015-7548 Affects ~~~~~~~ - Nova: <=2015.1.2, ==12.0.0 Description ~~~~~~~~~~~ Matthew Booth from Red Hat reported a vulnerability in Nova instance snapshot. By overwriting the disk inside an instance with a malicious image and requesting a snapshot, an authenticated user would be able to read an arbitrary file from the compute host. Note that the host file needs to be readable by the nova user to be exposed except when using lvm for instance storage, when all files readable by root are exposed. Only setups using libvirt to spawn instances are vulnerable. Of these, setups which use filesystem storage, and do not set "use_cow_images = False" in Nova configuration are not affected. Setups which use ceph or lvm for instance storage, and setups which use filesystem storage with "use_cow_images = False" are all affected. Patches ~~~~~~~ - https://review.openstack.org/264819 (Kilo) - https://review.openstack.org/264820 (Kilo) - https://review.openstack.org/264821 (Kilo) - https://review.openstack.org/264815 (Liberty) - https://review.openstack.org/264816 (Liberty) - https://review.openstack.org/264817 (Liberty) - https://review.openstack.org/264812 (Mitaka) - https://review.openstack.org/264813 (Mitaka) - https://review.openstack.org/264814 (Mitaka) Credits ~~~~~~~ - Matthew Booth from Red Hat (CVE-2015-7548) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1524274 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7548 Notes ~~~~~ - This fix will be included in future 2015.1.3 (kilo) and 12.0.1 (liberty) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 473 bytes Desc: OpenPGP digital signature URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20160107/067139d3/attachment.pgp>