via direct contact, embargoed until Oct 2nd 2014, 1500UTC


This is an advance warning of a vulnerability discovered in OpenStack,
to give you, as downstream stakeholders, a chance to coordinate the
release of fixes and reduce the vulnerability window. Please treat the
following information as confidential until the proposed public
disclosure date.

Title: Cinder-volume host data leak to vm instance
Reporter: Duncan Thomas (HP)
Products: Cinder
Versions: up to 2014.1.2

Description:
Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder
GlusterFS and Linux Smbfs driver. By overwriting a volume from within an
instance with a malicious qcow2 header, an authenticated user may be
able to clone and attach that corrupted volume resulting in affected
drivers leaking an arbitrary file from the Cinder-volume host to the
virtual instance. Note that the host file must be readable by the Cinder
context to be exposed. Only Cinder setups using GlusterFS volume driver
configured with glusterfs_qcow2_volumes=False (which is the default) or
Cinder setups using Smbfs volume driver configured with
smbfs_default_volume_format=raw (which is not the default) are affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/icehouse and master (Juno Development branch)
on the public disclosure date.

CVE: CVE-2014-3641

Proposed public disclosure date/time:
2014-10-02, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.

Regards,

-- 
Tristan Cacqueray
OpenStack Vulnerability Management Team