Bug 836077 (CVE-2012-3361)

Summary: CVE-2012-3361 OpenStack-Nova: compute nodes disk image file corruption
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akscram, alexander.sakhnov, apevec, apevec, asalkeld, bfilippov, breu, d.busby, Jan.van.Eldik, jonathansteffan, jose.castro.leon, markmc, matt_domsch, mlvov, pbrady, p, rbryant, rkukura, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-09-12 19:05:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 844038, 844039    
Bug Blocks:    

Description Kurt Seifried 2012-06-28 03:46:56 UTC 
Thierry Carrez <thierry> reports:

Pádraig Brady (Red Hat) Products: Nova Affects: All versions

Upon further inspection of the code, Pádraig Brady from Red Hat
found an additional vulnerability. By crafting a malicious image
and requesting an instance based on it, a remote authenticated user
may corrupt arbitrary files on the host filesystem, potentially
resulting in a denial of service. This affects all setups.
Comment 1 Kurt Seifried 2012-07-03 19:24:28 UTC 
This is public now www.openwall.com/lists/oss-security/2012/07/03/2 filing trackers
Comment 2 Tomas Hoger 2012-07-04 07:33:59 UTC 
References:

https://bugs.launchpad.net/nova/+bug/1015531

http://www.openwall.com/lists/oss-security/2012/07/03/2

Fixes:
Folsom:
https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7
Essex:
https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9
Diablo:
see patch at https://review.openstack.org/9268
Comment 3 Kurt Seifried 2012-07-28 06:16:15 UTC 
Created openstack-nova tracking bugs for this issue

Affects: fedora-all [bug 844038]
Comment 4 Kurt Seifried 2012-07-28 06:18:34 UTC 
Created openstack-nova tracking bugs for this issue

Affects: epel-6 [bug 844039]