Open Stack

===================================================================
OSSA-2020-006: Live migration fails to update persistent domain XML
===================================================================

:Date: August 25, 2020
:CVE: CVE-2020-17376


Affects
~~~~~~~
- Nova: <19.3.1, >=20.0.0 <20.3.1, ==21.0.0


Description
~~~~~~~~~~~
Tadayoshi Hosoya (NEC) and Lee Yarwood (Red Hat) reported a
vulnerability in Nova live migration. By performing a soft reboot of
an instance which has previously undergone live migration, a user may
gain access to destination host devices that share the same paths as
host devices previously referenced by the virtual machine on the
source. This can include block devices that map to different Cinder
volumes on the destination than the source. The risk is increased
significantly in non-default configurations allowing untrusted users
to initiate live migrations, so administrators may consider
temporarily disabling this in policy if they cannot upgrade
immediately. This only impacts deployments where users are allowed to
perform soft reboots of server instances; it is recommended to disable
soft reboots in policy (only allowing hard reboots) until the fix can
be applied.


Patches
~~~~~~~
- https://review.opendev.org/747978 (Pike)
- https://review.opendev.org/747976 (Queens)
- https://review.opendev.org/747975 (Rocky)
- https://review.opendev.org/747974 (Stein)
- https://review.opendev.org/747973 (Train)
- https://review.opendev.org/747972 (Ussuri)
- https://review.opendev.org/747969 (Victoria)


Credits
~~~~~~~
- Tadayoshi Hosoya from NEC (CVE-2020-17376)
- Lee Yarwood from Red Hat (CVE-2020-17376)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1890501
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17376


Notes
~~~~~
- The stable/rocky, stable/queens, and stable/pike branches are under extended
  maintenance and will receive no new point releases, but patches for them are
  provided as a courtesy.


-- 
Jeremy Stanley
OpenStack Vulnerability Management Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20200825/1c56afc8/attachment.sig>