The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty),
    when using raw storage and use_cow_images is set to false, allows remote authenticated users to read
    arbitrary files via a crafted qcow2 header in an ephemeral or root disk. (CVE-2016-2140)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0364 advisory.

    OpenStack Compute (nova) launches and schedules large networks of     virtual machines, creating a redundant and scalable cloud computing     platform. Compute provides the software, control panels, and APIs     required to orchestrate a cloud, including running virtual machine     instances and controlling access through users and projects.

    An information-exposure flaw was found in the OpenStack Compute (nova)     resize and migrate functionality. An authenticated user could write a     malicious qcow header to an ephemeral or root disk, referencing a block     device as a backing file. With a subsequent resize or migration, file     system content on the specified device would be leaked to the user. Only     setups using libvirt with raw storage and use_cow_images = False were     affected. (CVE-2016-2140)

    This issue was discovered by Matthew Booth of Red Hat.

    All openstack-nova users are advised to upgrade to these updated packages,     which correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3449-1 advisory.

    George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote     authenticated user could use this issue to consume resources, resulting in a denial of service.
    (CVE-2015-3241)

    George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A     remote authenticated user could use this issue to consume disk resources, resulting in a denial of     service. (CVE-2015-3280)

    It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A remote authenticated user     could use this issue to consume resources, resulting in a denial of service. (CVE-2015-5162)

    Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots. A remote authenticated user     could use this issue to read arbitrary files. (CVE-2015-7548)

    Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied security group changes. A     remote attacker could possibly use this issue to bypass intended restriction changes by leveraging an     instance that was running when the change was made. (CVE-2015-7713)

    Matt Riedemann discovered that OpenStack Nova incorrectly handled logging. A local attacker could possibly     use this issue to obtain sensitive information from log files. (CVE-2015-8749)

    Matthew Booth discovered that OpenStack Nova incorrectly handled certain qcow2 headers. A remote     authenticated user could possibly use this issue to read arbitrary files. (CVE-2016-2140)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
434456	SCA: security update for nova (GHSA-49jv-37hm-6gfp)	Tenable Cloud Security	SCA Checks	medium
434456	SCA: security update for nova (GHSA-49jv-37hm-6gfp)	Tenable Self-Hosted Container Security	SCA Checks	medium
234394	RHEL 7 : openstack-nova (RHSA-2016:0364)	Nessus	Red Hat Local Security Checks	medium
103812	Ubuntu 14.04 LTS : OpenStack Nova vulnerabilities (USN-3449-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2016-2140

medium

Tenable Plugins

medium

medium

medium

medium