CVE-2016-2140: Infoleak
It was reported that by overwriting an ephemeral or root disk with a malicious image before requesting a resize, an authenticated user may be able to read arbitrary files from the compute host. Only setups using libvirt driver with raw storage and setting "usecowimages = False" (not default) are affected.
Affected versions: <=2015.1.2, >=12.0.0 <=12.0.2
Other sources
The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and usecowimages is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2140?
CVE-2016-2140 is considered a moderate severity vulnerability due to its ability to allow authenticated users to read arbitrary files on the compute host.
How do I fix CVE-2016-2140?
To fix CVE-2016-2140, upgrade OpenStack Nova to version 12.0.3 or higher, or to version 2015.1.4 if using older releases.
What systems are affected by CVE-2016-2140?
CVE-2016-2140 affects OpenStack Nova versions between 12.0.0 and 12.0.3, as well as versions between 2015.1.0 and 2015.1.4 when using the libvirt driver with specific configurations.
Can an unauthenticated user exploit CVE-2016-2140?
No, CVE-2016-2140 can only be exploited by authenticated users who have access to the compute host.
What conditions must be met for CVE-2016-2140 to be exploitable?
CVE-2016-2140 is exploitable only on setups using the libvirt driver with raw storage and where 'use_cow_images' is set to False.