PT-2014-3265 · Red Hat+2 · Libvirt+3

Loganathan Parthipan + 1 · Published 2014-02-06 · Updated 2022-05-17 · CVE-2013-7130

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Grizzly through Icehouse

Description The issue arises from the i create images and backing method in the libvirt driver, specifically when utilizing KVM live block migration. This method fails to create all expected files, allowing attackers to access the snapshot root disk contents of other users via ephemeral storage.

Recommendations For OpenStack Compute (Nova) versions Grizzly through Icehouse, consider restricting access to the ephemeral storage to minimize the risk of exploitation until a proper fix is applied. As a temporary workaround, review and adjust the configuration of the libvirt driver to ensure proper file creation during KVM live block migration.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-7130

GHSA-99RX-9X8V-9J8P

PYSEC-2014-111

RHSA-2014:0231

RHSA-2014:0366

USN-2247-1

Affected Products

Kvm

Openstack Compute

Ubuntu

Libvirt

References · 36

• https://review.openstack.org/#/c/68660 · Patch
• https://osv.dev/vulnerability/USN-2247-1 · Vendor Advisory
• http://secunia.com/advisories/56450 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99rx-9x8v-9j8p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7130 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0231.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7130 · Security Note
• https://ubuntu.com/security/CVE-2013-7130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1068 · Vendor Advisory
• https://review.openstack.org/#/c/68658 · Patch
• http://ubuntu.com/usn/USN-2247-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4463 · Vendor Advisory