Bug 1112499 – CVE-2014-3517 openstack-nova: timing attack issue allows access to other instances' configuration information

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1112499 - (CVE-2014-3517) CVE-2014-3517 openstack-nova: timing attack issue allows access to other instances' configuration information

Summary:	CVE-2014-3517 openstack-nova: timing attack issue allows access to other inst...

Status:	CLOSED ERRATA

Aliases:	CVE-2014-3517

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140717,repor...
Keywords:	Security

Depends On:	1120952 1118179 1120316 1120951 1120953 1120954 1121804
Blocks:	1112500
	Show dependency tree / graph

Reported:	2014-06-24 01:09 EDT by Murray McAllister
Modified:	2016-04-26 12:38 EDT (History)
CC List:	19 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-08-21 01:00:31 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Launchpad	1325128	None	None	None	Never
Red Hat Product Errata	RHSA-2014:0940	normal	SHIPPED_LIVE	Moderate: openstack-nova security and bug fix update	2014-07-24 17:21:42 EDT
Red Hat Product Errata	RHSA-2014:1084	normal	SHIPPED_LIVE	Moderate: openstack-nova security, bug fix, and enhancement update	2014-08-21 00:34:32 EDT

Groups: None (edit)

Description Murray McAllister 2014-06-24 01:09:37 EDT

The OpenStack project reports:

""
Title: Use of non-constant time comparison operation
Reporter: Alex Gaynor (Rackspace)
Products: Nova
Versions: Up to 2013.2.3, and 2014.1 to 2014.1.1

Alex Gaynor from Rackspace reported a timing attack vulnerability in
Nova. By analyzing response times to requests for instance metadata, an
attacker may be able to guess a valid instance ID signature. This could
allow access to important configuration details of another instance.
Only setups configured to proxy metadata requests via Neutron are affected.
""

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Alex Gaynor from Rackspace as the original reporter.

Comment 7 Garth Mollett 2014-07-17 23:38:17 EDT

Created openstack-nova tracking bugs for this issue:

Affects: epel-6 [bug 1120951]

Comment 8 Garth Mollett 2014-07-17 23:39:15 EDT

Created openstack-nova tracking bugs for this issue:

Affects: fedora-19 [bug 1120953]
Affects: fedora-20 [bug 1120954]

Comment 10 errata-xmlrpc 2014-07-24 13:23:02 EDT

This issue has been addressed in following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:0940 https://rhn.redhat.com/errata/RHSA-2014-0940.html

Comment 11 Martin Prpič 2014-07-28 07:06:29 EDT

IssueDescription:

A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron.

Comment 12 errata-xmlrpc 2014-08-20 20:40:24 EDT

This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1084 https://rhn.redhat.com/errata/RHSA-2014-1084.html

Note You need to log in before you can comment on or make changes to this bug.