OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0208 advisory.

    The openstack-nova packages provide OpenStack Compute (code name Nova), a     cloud computing fabric controller.

    The openstack-nova packages have been upgraded to upstream version     2012.2.2, which provides a number of bug fixes over the previous version.

    This update also fixes the following security issues:

    It was found that the boot-from-volume feature in nova-volume did not     correctly validate if the user attempting to boot an image was permitted     to do so. An authenticated user could use this flaw to bypass     intended restrictions, allowing them to boot images they would otherwise     not have access to, exposing data stored in other users' images. This     issue did not affect configurations using the Cinder block storage     mechanism, which is the default in Red Hat OpenStack. (CVE-2013-0208)

    When OpenStack Nova was configured to provide guest instances with libvirt     and said guests used LVM-backed ephemeral storage     (libvirt_images_type=lvm in /etc/nova/nova.conf), the contents of the     physical volume were not wiped before the volume was returned to the system     for use by a different guest instance. This could lead to a new instance     being able to access files and data from a previous instance. This issue     did not affect configurations using the Cinder block storage mechanism,     which is the default in Red Hat OpenStack. (CVE-2012-5625)

    Red Hat would like to thank the OpenStack project for reporting these     issues. Upstream acknowledges Phil Day as the original reporter of     CVE-2013-0208, and Eric Windisch as the original reporter of CVE-2012-5625.

    All users of openstack-nova are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Nova running services will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Update to folsom stable release 2

    - Fix rpc_control_exchange regression.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Eric Windisch discovered that Nova did not properly clear LVM-backed images before they were reallocated which could potentially lead to an information leak. This issue only affected setups using libvirt LVM-backed instances.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210208	RHEL 6 : openstack-nova (RHSA-2013:0208)	Nessus	Red Hat Local Security Checks	high
63494	Fedora 18 : openstack-nova-2012.2.2-1.fc18 (2012-20462)	Nessus	Fedora Local Security Checks	medium
63261	Ubuntu 12.10 : nova vulnerability (USN-1663-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-5625

high

Tenable Plugins

high

medium

medium