[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1c828b01-0878-015c-8510-e3f2bfc411ff@redhat.com>
Date: Fri, 21 Jul 2017 10:50:26 +0100
From: Luke Hinds <lhinds@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: [OSSN-0078] Ceph credentials included in logs using older versions of
libvirt/qemu
Ceph credentials included in logs using older versions of libvirt/qemu
----------------------------------------------------------------------
### Summary ###
Older versions of libvirt included network storage authentication
information on the qemu command line. If libvirt raises an exception
which logs the qemu command line it used, for example an error starting
a domain, this authentication information will available in the logs.
### Affected Services / Software ###
Versions 2.5 and earlier of QEMU and libvirt versions of 2.1 or earlier.
The issue has been resolved in all QEMU versions 2.6 and above and
libvirt 2.2 and above.
No patches or specific releases of Nova or Ceph are required, the
issue is completely resolved in QEMU and libvirt.
### Discussion ###
If a deployment is using ceph, a libvirt error starting a domain would
log the cephx secret key and the monitor addresses on the qemu command
line.
A local attacker could then use this flaw to gain access of the cephx
secret key and perform certain privileged operations within the cluster.
An existing CVE is already present for this issue.
### Recommended Actions ###
The issue has been resolved upstream. Users running qemu version 2.6 or
later, and libvirt version 2.2 or later, are not vulnerable.
No change is required in Nova or Ceph to resolve this issue.
### Contacts / References ###
Author: Luke Hinds, Red Hat
https://access.redhat.com/security/cve/CVE-2015-5160
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0079
Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1686743
OpenStack Security Project : https://launchpad.net/~openstack-ossg
Download attachment "signature.asc" of type "application/pgp-signature" (513 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
