Comment 21 for bug 1524274
Revision history for this message
| Tristan Cacqueray (tristan-cacqueray) wrote Re: Unprivileged api user can access host data using instance snapshot | #21 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
bbfa235
(Get the code!)
The migration case is also worrisome, the exploit may be prevented by another bug or something... We should fix it in another patch (and maybe another bug-report) only if we are confident this is not exploitable. Otherwise I would suggest we fix all qemu-img convert trickery in a single advisory.
Here is another draft that only covers the snapshot case with the description proposed by Matthew:
Title: Nova host data leak through snapshot
Reporter: Matthew Booth (Red Hat)
Products: Nova
Versions: <=2015.1.2, ==12.0.0
Description:
Matthew Booth from Red Hat reported a vulnerability in Nova instance snapshot. By overwriting the disk inside an instance with a malicious image and requesting a snapshot, an authenticated user would be able to read an arbitrary file from the compute host. Note that the host file needs to be readable by the nova user to be exposed except when using lvm for instance storage, when all files readable by root are exposed. Only setups using libvirt to spawn instances are vulnerable. Of these, setups which use filesystem storage, and do not set "use_cow_images = False" in Nova configuration are not affected. Setups which use ceph, lvm, or ploop for instance storage, and setups which use filesystem storage with "use_cow_images = False" are all affected.