Vulnerability Description
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Compute | 2012.2 |
| Openstack | Grizzly | - |
| Openstack | Havana | - |
| Openstack | Icehouse | - |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.h
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.h
- http://osvdb.org/102416
- http://rhn.redhat.com/errata/RHSA-2014-0231.html
- http://secunia.com/advisories/56450Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/01/23/5
- http://www.securityfocus.com/bid/65106
- http://www.ubuntu.com/usn/USN-2247-1
- https://bugs.launchpad.net/nova/+bug/1251590
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90652
- https://review.openstack.org/#/c/68658/Patch
- https://review.openstack.org/#/c/68659/
- https://review.openstack.org/#/c/68660/Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.h
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.h
FAQ
What is CVE-2013-7130?
CVE-2013-7130 is a vulnerability with a CVSS score of 7.1 (HIGH). The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not proper...
How severe is CVE-2013-7130?
CVE-2013-7130 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-7130?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Compute, Openstack Grizzly, Openstack Havana, Openstack Icehouse.