PT-2014-3265 · Red Hat+2 · Libvirt+3

Loganathan Parthipan + 1 · Publicado 2014-02-06 · Atualizado 2022-05-17 · CVE-2013-7130

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Grizzly through Icehouse

Description The issue arises from the i create images and backing method in the libvirt driver, specifically when utilizing KVM live block migration. This method fails to create all expected files, allowing attackers to access the snapshot root disk contents of other users via ephemeral storage.

Recommendations For OpenStack Compute (Nova) versions Grizzly through Icehouse, consider restricting access to the ephemeral storage to minimize the risk of exploitation until a proper fix is applied. As a temporary workaround, review and adjust the configuration of the libvirt driver to ensure proper file creation during KVM live block migration.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-7130

GHSA-99RX-9X8V-9J8P

PYSEC-2014-111

RHSA-2014:0231

RHSA-2014:0366

USN-2247-1

Produtos afetados

Kvm

Openstack Compute

Ubuntu

Libvirt

Referências · 36

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/b0d36683fe064b32cbef013e1c0c46bd018ab9a1 · Nota
• https://github.com/openstack/nova/commit/15ee7e17f63f5583307a546ecf28952c364c88f9 · Nota
• https://github.com/openstack/nova/commit/cbeb5e51886b0296349fc476305bfe3d63c627c3 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-111.yaml · Nota
• https://review.openstack.org/#/c/68660 · Correção
• https://osv.dev/vulnerability/USN-2247-1 · Aviso do Fabricante
• http://secunia.com/advisories/56450 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-99rx-9x8v-9j8p · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7130 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-7130 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2014-0231.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-7130 · Nota de Segurança
• http://securityfocus.com/bid/65106 · Nota
• https://ubuntu.com/security/CVE-2013-7130 · Aviso do Fabricante