CVEvulnerability
CVE-2013-7130
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-02-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.1 HIGH — AV:N/AC:M/Au:N/C:C/I:N/A:N
- Weaknesses
- CWE-200
Description
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
Affected configurations
• openstack compute 2012.2
• openstack compute 2013.1
• openstack compute 2013.1.1
• openstack compute 2013.1.2
• openstack compute 2013.1.3
• openstack grizzly
• openstack havana
• openstack icehouse
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html lists.fedoraproject.org
- http://osvdb.org/102416 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2014-0231.html rhn.redhat.com
- http://secunia.com/advisories/56450 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/01/23/5 www.openwall.com
- http://www.securityfocus.com/bid/65106 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2247-1 www.ubuntu.com
- https://bugs.launchpad.net/nova/+bug/1251590 bugs.launchpad.net
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90652 exchange.xforce.ibmcloud.com
- https://review.openstack.org/#/c/68658/ Patch
- https://review.openstack.org/#/c/68659/ review.openstack.org
- https://review.openstack.org/#/c/68660/ Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html lists.fedoraproject.org
- http://osvdb.org/102416 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2014-0231.html rhn.redhat.com
- http://secunia.com/advisories/56450 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/01/23/5 www.openwall.com
- http://www.securityfocus.com/bid/65106 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2247-1 www.ubuntu.com
- https://bugs.launchpad.net/nova/+bug/1251590 bugs.launchpad.net
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90652 exchange.xforce.ibmcloud.com
- https://review.openstack.org/#/c/68658/ Patch
- https://review.openstack.org/#/c/68659/ review.openstack.org
- https://review.openstack.org/#/c/68660/ Patch