Bug 1112499 (CVE-2014-3517) - CVE-2014-3517 openstack-nova: timing attack issue allows access to other instances' configuration information
Summary: CVE-2014-3517 openstack-nova: timing attack issue allows access to other inst...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3517
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1118179 1120316 1120951 1120952 1120953 1120954 1121804
Blocks: 1112500
TreeView+ depends on / blocked
 
Reported: 2014-06-24 05:09 UTC by Murray McAllister
Modified: 2023-05-12 03:47 UTC (History)
19 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron.
Clone Of:
Environment:
Last Closed: 2014-08-21 05:00:31 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1325128 0 None None None Never
Red Hat Product Errata RHSA-2014:0940 0 normal SHIPPED_LIVE Moderate: openstack-nova security and bug fix update 2014-07-24 21:21:42 UTC
Red Hat Product Errata RHSA-2014:1084 0 normal SHIPPED_LIVE Moderate: openstack-nova security, bug fix, and enhancement update 2014-08-21 04:34:32 UTC

Description Murray McAllister 2014-06-24 05:09:37 UTC 
The OpenStack project reports:

""
Title: Use of non-constant time comparison operation
Reporter: Alex Gaynor (Rackspace)
Products: Nova
Versions: Up to 2013.2.3, and 2014.1 to 2014.1.1

Alex Gaynor from Rackspace reported a timing attack vulnerability in
Nova. By analyzing response times to requests for instance metadata, an
attacker may be able to guess a valid instance ID signature. This could
allow access to important configuration details of another instance.
Only setups configured to proxy metadata requests via Neutron are affected.
""

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Alex Gaynor from Rackspace as the original reporter.
Comment 7 Garth Mollett 2014-07-18 03:38:17 UTC 
Created openstack-nova tracking bugs for this issue:

Affects: epel-6 [bug 1120951]
Comment 8 Garth Mollett 2014-07-18 03:39:15 UTC 
Created openstack-nova tracking bugs for this issue:

Affects: fedora-19 [bug 1120953]
Affects: fedora-20 [bug 1120954]
Comment 10 errata-xmlrpc 2014-07-24 17:23:02 UTC 
This issue has been addressed in following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:0940 https://rhn.redhat.com/errata/RHSA-2014-0940.html
Comment 11 Martin Prpič 2014-07-28 11:06:29 UTC 
IssueDescription:

A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron.
Comment 12 errata-xmlrpc 2014-08-21 00:40:24 UTC 
This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1084 https://rhn.redhat.com/errata/RHSA-2014-1084.html
Note You need to log in before you can comment on or make changes to this bug.