CVE-2014-3641

Advisory

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.


MLIST:[oss-security] 20141002 [OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641): http://seclists.org/oss-sec/2014/q4/78
CONFIRM:https://bugs.launchpad.net/cinder/+bug/1350504: https://bugs.launchpad.net/cinder/+bug/1350504
REDHAT:RHSA-2014:1787: http://rhn.redhat.com/errata/RHSA-2014-1787.html
REDHAT:RHSA-2014:1788: http://rhn.redhat.com/errata/RHSA-2014-1788.html
UBUNTU:USN-2405-1: http://www.ubuntu.com/usn/USN-2405-1
BID:70221: http://www.securityfocus.com/bid/70221

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3641
• http://seclists.org/oss-sec/2014/q4/78
• http://www.securityfocus.com/bid/70221
• https://bugs.launchpad.net/cinder/+bug/1350504
• http://rhn.redhat.com/errata/RHSA-2014-1788.html
• http://rhn.redhat.com/errata/RHSA-2014-1787.html
• http://www.ubuntu.com/usn/USN-2405-1