Able to show volumes associated with different project

[git-harry]

https://github.com/openstack/cinder/commit/0505bb268942534ad5d6ecd5e34a4d9b0e7f5c04 appears to have introduced a bug making it possible to show the details of a volume under another project_id.

$ . ~/devstack/openrc demo demo
$ cinder list
+--------------------------------------+-----------+-------+------+-------------+----------+-------------+
| ID | Status | Name | Size | Volume Type | Bootable | Attached to |
+--------------------------------------+-----------+-------+------+-------------+----------+-------------+
| c99fe35a-47ef-448a-af31-edf7d04cd44a | available | demo1 | 1 | lvmdriver-1 | false | |
+--------------------------------------+-----------+-------+------+-------------+----------+-------------+
$ cinder list --all-tenants 1
+--------------------------------------+----------------------------------+-----------+-------+------+-------------+----------+-------------+
| ID | Tenant ID | Status | Name | Size | Volume Type | Bootable | Attached to |
+--------------------------------------+----------------------------------+-----------+-------+------+-------------+----------+-------------+
| c99fe35a-47ef-448a-af31-edf7d04cd44a | 807f2a0ef357420e9a70ac1a5fef7a4c | available | demo1 | 1 | lvmdriver-1 | false | |
+--------------------------------------+----------------------------------+-----------+-------+------+-------------+----------+-------------+
$ cinder show ad3194a3-8304-4d17-8f66-f1a1a261d339
+------------------------------+--------------------------------------+
| Property | Value |
+------------------------------+--------------------------------------+
| attachments | [] |
| availability_zone | nova |
| bootable | false |
| created_at | 2014-08-12T11:06:33.000000 |
| description | None |
| encrypted | False |
| id | ad3194a3-8304-4d17-8f66-f1a1a261d339 |
| metadata | {} |
| name | admin1 |
| os-vol-tenant-attr:tenant_id | e66effcd5db642dfabceabc76ea78196 |
| size | 1 |
| snapshot_id | None |
| source_volid | None |
| status | available |
| user_id | 7e540d1944a74bd4a90aa9a8b15d09b0 |
| volume_type | lvmdriver-1 |
+------------------------------+--------------------------------------+

[git-harry (git-harry)]

https://review.openstack.org/113886

[Tristan Cacqueray (tristan-cacqueray)]

Thanks for the report, I've set the OSSA task to incomplete, pending additional details from @cinder-coresec.
Though this require knowledge of UUID and may not represent a vulnerability as-is.

Also, now that a review have been submitted we may mark this report Public security.

[Thierry Carrez (ttx)]

This looks like a regression in development release. As long as it's fixed in Juno final release, we should not issue an advisory about it.

[Thierry Carrez (ttx)]

Hrm, that was backported to icehouse

[Ihar Hrachyshka (ihar-hrachyshka)]

BTW the stable/icehouse patch was backported against the stable maint rules (one core pushed the patch without waiting for approval from another core). Just sayin'.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/113886
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=5868e8f285d23b56ca6123dab760342c57bf8c80
Submitter: Jenkins
Branch: master

commit 5868e8f285d23b56ca6123dab760342c57bf8c80
Author: git-harry <email address hidden>
Date: Wed Aug 13 14:22:49 2014 +0100

    Prevent tenant viewing volumes owed by another

    Bug introduced by 0505bb268942534ad5d6ecd5e34a4d9b0e7f5c04 allows any
    tenant to get the details of a volume belonging to any other tenant
    if the UUID is known.

    This commit allows only the tenant or an admin to get a volume.

    Change-Id: I0268d374f7529d89068dcbf3c1cb9ab3d60d4115
    Closes-Bug: #1356368

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/115304

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/115304
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=d6d75f868d5da77c2c8e20d0562555a14a6f91ec
Submitter: Jenkins
Branch: master

commit d6d75f868d5da77c2c8e20d0562555a14a6f91ec
Author: Zhiteng Huang <email address hidden>
Date: Tue Aug 19 22:27:26 2014 +0800

    Honor volume:get policy

    The fix for bug 1356368 hard-coded a policy check (same as
    rule:admin_or_owner) for volume:get. While in most cases this is
    what people want, it'd be good we honor policy setting.

    Note that before commit 0505bb268942534ad5d6ecd5e34a4d9b0e7f5c04,
    DB query volume_get() actually acted as the policy checker for
    volume:get, and it raised VolumeNotFound if context.project_id didn't
    match volume['project_id']. The check_policy() in volume:get didn't
    get a chance to raise PolicyNotAuthorized exception. So in this
    change we keep the same behavor.

    Change-Id: If43cec5cce977b9220296709b4e243b35b06ecd5
    Related-bug: #1356368

[Thierry Carrez (ttx)]

Since this requires guessing the UUID, it's not really a practical attack, and the info leaked in the unlikely case you guess the UUID is not exactly critical. I think we need to fix the regression, but can pass on a security advisory here. Thoughts ?

[Thierry Carrez (ttx)]

Unless someone complains before Monday, I propose we don't publish an advisory here (not an exploitable vulnerability).
This still needs to be backported to icehouse though.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/117546

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/117550

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/117546
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=da65d08f20021ac60a8c6fc2b5577b60911aeb79
Submitter: Jenkins
Branch: stable/icehouse

commit da65d08f20021ac60a8c6fc2b5577b60911aeb79
Author: git-harry <email address hidden>
Date: Wed Aug 13 14:22:49 2014 +0100

    Prevent tenant viewing volumes owned by another

    Bug introduced by 0505bb268942534ad5d6ecd5e34a4d9b0e7f5c04 allows any
    tenant to get the details of a volume belonging to any other tenant
    if the UUID is known.

    This commit allows only the tenant or an admin to get a volume.

    Change-Id: I0268d374f7529d89068dcbf3c1cb9ab3d60d4115
    Closes-Bug: #1356368
    (cherry picked from commit 5868e8f285d23b56ca6123dab760342c57bf8c80)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/117550
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=c2826368c2992668a25e026bdc57f0a2ed6f1773
Submitter: Jenkins
Branch: stable/icehouse

commit c2826368c2992668a25e026bdc57f0a2ed6f1773
Author: Zhiteng Huang <email address hidden>
Date: Tue Aug 19 22:27:26 2014 +0800

    Honor volume:get policy

    The fix for bug 1356368 hard-coded a policy check (same as
    rule:admin_or_owner) for volume:get. While in most cases this is
    what people want, it'd be good we honor policy setting.

    Note that before commit 0505bb268942534ad5d6ecd5e34a4d9b0e7f5c04,
    DB query volume_get() actually acted as the policy checker for
    volume:get, and it raised VolumeNotFound if context.project_id didn't
    match volume['project_id']. The check_policy() in volume:get didn't
    get a chance to raise PolicyNotAuthorized exception. So in this
    change we keep the same behavor.

    Change-Id: If43cec5cce977b9220296709b4e243b35b06ecd5
    Related-bug: #1356368
    (cherry picked from commit d6d75f868d5da77c2c8e20d0562555a14a6f91ec)