CVE-2013-7130: Infoleak
The icreateimagesandbacking (aka createimagesandbacking) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 12.0.0a0
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7130?
CVE-2013-7130 is considered a medium severity vulnerability.
How do I fix CVE-2013-7130?
To fix CVE-2013-7130, upgrade the OpenStack Compute (Nova) package to version 12.0.0a0 or later.
Which versions of OpenStack are affected by CVE-2013-7130?
CVE-2013-7130 affects OpenStack Compute versions Grizzly, Havana, and Icehouse.
What is the potential impact of CVE-2013-7130?
The potential impact of CVE-2013-7130 is that attackers may gain access to snapshot root disk contents of other users.
What component is primarily affected by CVE-2013-7130?
CVE-2013-7130 primarily affects the libvirt driver in OpenStack Compute.