Created attachment 660748 [details]
Collection of patches

This is an advance warning of a vulnerability discovered in OpenStack,
to give you, as downstream stakeholders, a chance to coordinate the
release of fixes and reduce the vulnerability window. Please treat the
following information as confidential until the proposed public
disclosure date.

Title: Nova host data leak through snapshot
Reporter: Matthew Booth (Red Hat)
Products: Nova
Versions: <=2015.1.2, ==12.0.0

Description:
Matthew Booth from Red Hat reported a vulnerability in Nova instance
snapshot. By overwriting the disk inside an instance with a malicious
image and requesting a snapshot, an authenticated user would be able to
read an arbitrary file from the compute host. Note that the host file
needs to be readable by the nova user to be exposed except when using
lvm for instance storage, when all files readable by root are exposed.
Only setups using libvirt to spawn instances are vulnerable. Of these,
setups which use filesystem storage, and do not set "use_cow_images =
False" in Nova configuration are not affected. Setups which use ceph or
lvm for instance storage, and setups which use filesystem storage with
"use_cow_images = False" are all affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/kilo, stable/liberty and master on the public
disclosure date.

CRD: 2016-01-07 1500 UTC