Attachment 687206 Details for Bug 902629 – essex-CVE-2013-0208-1069904-v2.patch

[patch] essex-CVE-2013-0208-1069904-v2.patch

essex-CVE-2013-0208-1069904-v2.patch (text/plain), 2.57 KB, created by Kurt Seifried on 2013-01-25 05:10:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-01-25 05:10:59 UTC

Size: 2.57 KB

patch

obsolete

>From e28269a34902ba43718622f454341c132fd14995 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?P=C3=A1draig=20Brady?= <pbrady@redhat.com>
>Date: Thu, 24 Jan 2013 10:45:19 +0000
>Subject: [PATCH] disallow boot from volume from specifying arbitrary volumes
>
>Fix a vulnerability in volume attachment in nova-volume, affecting the
>boot-from-volume feature.  By passing a specific volume ID, an
>authenticated user may be able to boot from a volume they don't own,
>potentially resulting in full access to that 3rd-party volume.
>
>Fixes bug: 1069904, CVE-2013-0208
>Change-Id: I5f7c8d20d3ebf33ce1ce64bf0a8418bd2b5a6411
>---
> nova/compute/api.py | 16 ++++++++++++++++
> nova/exception.py   | 14 ++++++++++++++
> 2 files changed, 30 insertions(+)
>
>diff --git a/nova/compute/api.py b/nova/compute/api.py
>index f64a10c..633e282 100644
>--- a/nova/compute/api.py
>+++ b/nova/compute/api.py
>@@ -390,6 +390,22 @@ class API(BaseAPI):
> 
>         LOG.debug(_("Going to run %s instances...") % num_instances)
> 
>+        # Validate the correct devices have been specified
>+        for bdm in block_device_mapping:
>+            # NOTE(vish): For now, just make sure the volumes are accessible.
>+            snapshot_id = bdm.get('snapshot_id')
>+            volume_id = bdm.get('volume_id')
>+            if volume_id is not None:
>+                try:
>+                    self.volume_api.get(context, volume_id)
>+                except Exception:
>+                    raise exception.InvalidBDMVolume(id=volume_id)
>+            elif snapshot_id is not None:
>+                try:
>+                    self.volume_api.get_snapshot(context, snapshot_id)
>+                except Exception:
>+                    raise exception.InvalidBDMSnapshot(id=snapshot_id)
>+
>         if create_instance_here:
>             instance = self.create_db_entry_for_new_instance(
>                     context, instance_type, image, base_options,
>diff --git a/nova/exception.py b/nova/exception.py
>index 107d926..1f1fa53 100644
>--- a/nova/exception.py
>+++ b/nova/exception.py
>@@ -309,6 +309,20 @@ class InstanceInvalidState(Invalid):
>                 "%(method)s while the instance is in this state.")
> 
> 
>+class InvalidBDM(Invalid):
>+    message = _("Block Device Mapping is Invalid.")
>+
>+
>+class InvalidBDMSnapshot(InvalidBDM):
>+    message = _("Block Device Mapping is Invalid: "
>+                "failed to get snapshot %(id)s.")
>+
>+
>+class InvalidBDMVolume(InvalidBDM):
>+    message = _("Block Device Mapping is Invalid: "
>+                "failed to get volume %(id)s.")
>+
>+
> class InstanceNotRunning(Invalid):
>     message = _("Instance %(instance_id)s is not running.")
> 
>-- 
>1.8.1
>

Actions: View | Diff

Attachments on bug 902629: 684893 | 684894 | 687206 | 687207