[OSSA 2013-001] No authentication on block device used for os-volume_boot
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Compute (nova) |
Fix Released
|
Undecided
|
Pádraig Brady | ||
Folsom |
Fix Released
|
High
|
Pádraig Brady | ||
OpenStack Security Advisory |
Fix Released
|
Undecided
|
Thierry Carrez | ||
nova (Debian) |
Fix Released
|
Unknown
|
Bug Description
We found this problem in our Diablo code base - I think by inspection its still valid in upstream as well but a bit harder to check as the code has changed (BootFromVolume
Fillling anyway as its pretty serious, in the hope that someone can verify or dismiss it.
Boot from volume allows a volume to be passed to the create method via the block_device_
The volume ownership and status should be explicitly checked in the compute.api layer
CVE References
information type: | Private Security → Public Security |
Changed in nova (Debian): | |
status: | Unknown → Fix Released |
Changed in nova: | |
milestone: | none → grizzly-3 |
status: | Fix Committed → Fix Released |
Changed in nova: | |
milestone: | grizzly-3 → 2013.1 |
summary: |
- No authentication on block device used for os-volume_boot + [OSSA 2013-001] No authentication on block device used for os- + volume_boot |
Changed in ossa: | |
assignee: | nobody → Thierry Carrez (ttx) |
status: | New → Fix Released |
no longer affects: | nova/diablo |
no longer affects: | nova/essex |
The connection code attaches to the volume using api commands to cinder. Volumes belonging to other users will not be visible, so this shouldn't be possible in folsom.