CVE-2013-7130 OpenStack Nova Live migration can leak root disk into ephemeral storage
HighCVSS 7.1
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | < 12.0.0a0 | 12.0.0a0 |
| debian/nova(Debian:12) | < 2013.2.2 | 2013.2.2 |
| debian/nova(Debian:13) | < 2013.2.2 | 2013.2.2 |
| debian/nova(Debian:14) | < 2013.2.2 | 2013.2.2 |
| OpenStack compute | = 2012.2 | No fix listed |
| OpenStack compute | = 2013.1 | No fix listed |
| OpenStack compute | = 2013.1.1 | No fix listed |
| OpenStack compute | = 2013.1.2 | No fix listed |
| OpenStack compute | = 2013.1.3 | No fix listed |
| OpenStack grizzly | All versions | No fix listed |
| OpenStack havana | All versions | No fix listed |
| OpenStack icehouse | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net
- openstack-cve20137130-info-disc(90652) vdb-entry
- github.com product
- github.com
- review.openstack.org patch
- FEDORA-2014-1463 vendor-advisory
- FEDORA-2014-1516 vendor-advisory
- 102416 vdb-entry
- RHSA-2014:0231 vendor-advisory
- [oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130) mailing-list
- USN-2247-1 vendor-advisory
- 65106 vdb-entry
- 56450 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2013-7130 vendor-advisory
- github.com
- bugs.debian.org issue-tracking