Format-guessing and file disclosure in image convert (CVE-2015-1850)

[Ivan Kolodyazhny]

Cinder does not provide input format to several calls of "qemu-img convert". This allows the attacker to play the format guessing by providing a volume with a qcow2 signature. If this signature contains a base file, this file will be read by a process running as root and embedded in the output. This bug is similar to CVE-2013-1922.

Upstream bug: https://bugs.launchpad.net/cinder/+bug/1415087

[Vitaly Sedelnik (vsedelnik)]

The fix for stable/juno is merged in upstream so I am nominating it for 6.0-updates and including into MU4.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ivan Kolodyazhny <email address hidden> on branch: openstack-ci/fuel-7.0/2015.1.0
Review: https://review.fuel-infra.org/8096

[Timur Nurlygayanov (tnurlygayanov)]

Status of the issue for 6.1 is not clear, we have no any commits on review with this fix. Need to update the status of this bug and add some comments which will confirm that we have this fix in MOS 6.1

[Timur Nurlygayanov (tnurlygayanov)]

THis issue is not actual for MOS 7.0, because it was fixed in OpenStack upstream.

And this issue is already fixed in MOS 6.1 because we updated code from upstream too.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: openstack-ci/fuel-5.1.1-updates/2014.1.1
Change author: Eric Harney <email address hidden>
Review: https://review.fuel-infra.org/13124

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/13124
Submitter: Vitaly Sedelnik <email address hidden>
Branch: openstack-ci/fuel-5.1.1-updates/2014.1.1

Commit: f82390b5244137f82dd64a1f2a68448c293b391e
Author: Eric Harney <email address hidden>
Date: Fri Oct 23 13:20:08 2015

Disallow backing files when uploading volumes to image

Volumes with a header referencing a backing file can leak
file data into the destination image when uploading a
volume to an image.

Halt the upload process if the volume data references a
backing file to prevent this.

Closes-Bug: #1465333
Change-Id: Iab9718794e7f7e8444015712cfa08c46848ebf78
(cherry picked from commit 9634b76ba5886d6c2f2128d550cb005dabf48213)
Conflicts:
    cinder/tests/test_image_utils.py (backport to old tests)
(cherry picked from commit d31c937c566005dedf41a60c6b5bd5e7b26f221b)
Conflicts:
    cinder/tests/test_image_utils.py

[Vadim Rovachev (vrovachev)]

Steps to reproduce:
1. Create volume
2. Create VM(recomennted to use ubuntu/centos images, because for reproduce need package: qemu-utils)
3. Attach volume to vm
4. ssh to vm and run command: qemu-img create -f qcow2 -b /etc/passwd /dev/vdb
5. Deattach volume
6. ssh to one of controllers and run command: cinder upload-to-image --disk-format qcow2 --container-format bare <vol-id> <name>
7. run command: glance image-download <image-id> > file
8. Open and look into the file.
If bug is reproduced, file should contain info form file /etc/passwd

[Vadim Rovachev (vrovachev)]

Verified on 5.1.1