[Openstack] [OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)

Tristan Cacqueray tristan.cacqueray at enovance.com
Thu Mar 27 17:33:19 UTC 2014


OpenStack Security Advisory: 2014-009
CVE: CVE-2014-0134
Date: March 27, 2014
Title: Nova host data leak to vm instance in rescue mode.
Reporter: Stanislaw Pitucha (HP)
Products: Nova
Versions: 2013.2 versions up to 2013.2.2

Description:
Stanislaw Pitucha from Hewlett Packard reported a vulnerability in the
Nova instance rescue mode. By overwriting the disk inside an instance
with a malicious image and switching the instance to rescue mode, an
authenticated user would be able to leak an arbitrary file from the
compute host to the virtual instance. Note that the host file must be
readable by the libvirt/kvm context to be exposed. Only setups using
libvirt to spawn instance, and having "use_cow_images = False" in Nova
configuration are affected.

Icehouse (development branch) fix:
https://review.openstack.org/82840

Havana fix:
https://review.openstack.org/82841

Notes:
This fix will be included in the icehouse-rc1 development milestone and
in a future 2013.2.3 release.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0134
https://launchpad.net/bugs/1221190

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team





-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 555 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstack.org/pipermail/openstack/attachments/20140327/77d30ac0/attachment.sig>


More information about the Openstack mailing list