[OSSA 2016-001] Nova host data leak through snapshot
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Mirantis OpenStack |
Fix Released
|
High
|
MOS Nova | ||
5.1.x |
Fix Released
|
High
|
Alexey Stupnikov | ||
6.0.x |
Fix Released
|
High
|
Alexey Stupnikov | ||
6.1.x |
Fix Released
|
High
|
Alexey Stupnikov | ||
7.0.x |
Fix Released
|
High
|
Alexey Stupnikov | ||
8.0.x |
Fix Released
|
High
|
MOS Nova | ||
9.x |
Fix Released
|
High
|
MOS Nova |
Bug Description
Upstream bug: https:/
By overwriting the disk inside an instance with a malicious
image and requesting a snapshot, an authenticated user would be able to
read an arbitrary file from the compute host. Note that the host file
needs to be readable by the nova user to be exposed except when using
lvm for instance storage, when all files readable by root are exposed.
Only setups using libvirt to spawn instances are vulnerable. Of these,
setups which use filesystem storage, and do not set "use_cow_images =
False" in Nova configuration are not affected. Setups which use ceph or
lvm for instance storage, and setups which use filesystem storage with
"use_cow_images = False" are all affected.
CVE-2015-7548
CVE References
summary: |
- Nova host data leak through snapshot + [OSSA 2016-001] Nova host data leak through snapshot |
description: | updated |
tags: | added: on-verification |
information type: | Private Security → Public Security |
tags: | added: on-verification |
tags: | added: on-verification |
Fixed in Mitaka:
https:/ /review. openstack. org/#/q/ topic:bug/ 1524274