67 lines
1.8 KiB
YAML
67 lines
1.8 KiB
YAML
date: 2016-03-08
|
|
|
|
id: OSSA-2016-007
|
|
|
|
title: 'Nova host data leak through resize/migration'
|
|
|
|
description: 'Matthew Booth from Red Hat reported a vulnerability in Nova instance
|
|
resize/migration. By overwriting an ephemeral or root disk with a malicious
|
|
image before requesting a resize, an authenticated user may be able to read
|
|
arbitrary files from the compute host. Only setups using libvirt driver with
|
|
raw storage and setting "use_cow_images = False" (not default) are affected.'
|
|
|
|
errata: 'The former fix did not take into account the usage of non-disk-image
|
|
backends and caused a regression for this use-case. This update provides an
|
|
additional fix for that issue. Moreover, the kilo backport caused a regression
|
|
in live migration where the disk info file is JSON encoded. This second update
|
|
provides an additional fix for stable/kilo.'
|
|
|
|
affected-products:
|
|
|
|
- product: nova
|
|
version: "<=2015.1.3, >=12.0.0 <=12.0.2"
|
|
|
|
vulnerabilities:
|
|
|
|
- cve-id: CVE-2016-2140
|
|
|
|
reporters:
|
|
|
|
- name: 'Matthew Booth'
|
|
affiliation: Red Hat
|
|
reported:
|
|
- CVE-2016-2140
|
|
|
|
issues:
|
|
|
|
links:
|
|
- https://bugs.launchpad.net/bugs/1548450
|
|
- https://bugs.launchpad.net/bugs/1555287
|
|
- https://bugs.launchpad.net/bugs/1558697
|
|
|
|
reviews:
|
|
|
|
mitaka:
|
|
- https://review.openstack.org/289957 - original
|
|
- https://review.openstack.org/290715 - errata
|
|
|
|
liberty:
|
|
- https://review.openstack.org/289958 - original
|
|
- https://review.openstack.org/290843 - errata
|
|
|
|
kilo:
|
|
- https://review.openstack.org/289960 - original
|
|
- https://review.openstack.org/290847 - errata
|
|
- https://review.openstack.org/294205 - errata#2
|
|
|
|
type: gerrit
|
|
|
|
notes:
|
|
- 'This fix will be included in future 2015.1.4 (kilo) and 12.0.3 (liberty)
|
|
releases.'
|
|
|
|
errata_history:
|
|
- 2016-03-30 - Errata 2
|
|
- 2016-03-09 - Errata 1
|
|
- 2016-03-08 - Original Version
|