OpenStack Nova host data access through resize/migration
The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-2140US | medium5.3 | — | ||
The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote a… | ||||
02
references
External citations — patches, advisories, analysis.
- http://seclists.org/oss-sec/2016/q1/563WEB
- http://www.openwall.com/lists/oss-security/2016/03/08/6WEB
- http://www.securityfocus.com/bid/84277WEB
- https://access.redhat.com/errata/RHSA-2016:0363WEB
- https://access.redhat.com/errata/RHSA-2016:0364WEB
- https://access.redhat.com/errata/RHSA-2016:0365WEB
- https://access.redhat.com/errata/RHSA-2016:0366WEB
- https://access.redhat.com/security/cve/CVE-2016-2140WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan