Security Advisory Moderate: openstack-nova security, bug fix, and enhancement update

Advisory: RHSA-2014:0578-1
Type: Security Advisory
Severity: Moderate
Issued on: 2014-05-29
Last updated on: 2014-05-29
Affected Products: Red Hat OpenStack 4.0
CVEs (cve.mitre.org): CVE-2014-0134

Details

Updated openstack-nova packages that fix one security issue, several bugs,
and add one enhancement are now available for Red Hat Enterprise Linux
OpenStack Platform 4.0.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

OpenStack Compute (nova) launches and schedules large networks of virtual
machines, creating a redundant and scalable cloud computing platform.
Compute provides the software, control panels, and APIs required to
orchestrate a cloud, including running virtual machine instances, managing
networks, and controlling access through users and projects.

It was found that overwriting the disk inside of an instance with a
malicious image, and then switching the instance to rescue mode, could
potentially allow an authenticated user to access arbitrary files on the
compute host depending on the file permissions and SELinux constraints of
those files. Only setups that used libvirt to spawn instances and which had
the use of cow images disabled ("use_cow_images = False" in nova
configuration) were affected. (CVE-2014-0134)

Red Hat would like to thank the OpenStack Project for reporting this issue.
Upstream acknowledges Stanislaw Pitucha from Hewlett Packard as the
original reporter.

Bug fixes:

* The Compute libguestfs did not perform tear down correctly in certain
cases, such as when attempting to perform SSH key injection when no SSH
keys were specified. As a result, libguestfs qemu instances would remain
running, even after the Compute instance with which they were associated
was destroyed. This has been fixed and now tear down of libguestfs occurs
correctly. (BZ#1022627)

* Qpid's driver reconnection delay is not configurable. This and the fact
that the hard-coded delay was quite high became a blocker issue from an HA
perspective. Making this value configurable is not possible for this
version, so the hard-coded delay was changed. The new delay cap is 5
seconds. (BZ#1060772)

* Nova was creating a temporary VMware snapshot during a nova snapshot, but
not deleting it on completion. Thus VMware guests could end up with a large
number of unnecessary snapshots. The temporary VMware snapshot is now
deleted on completion of the nova snapshot operation. (BZ#1069429)

* The Nova vmware driver was not passing the iscsi server location to the
instance, hence it was not possible to add a cinder iscsi disk to a VMware
instance. The nova vmware driver now correctly passes the iscsi server
location to the instance and it is possible to add a cinder iscsi disk to a
VMware instance. (BZ#1069432)

* The nova VMware driver was assigning VNC ports in a way which could cause
collisions between guests. There was a small chance that 2 instances could
be created with the same VNC port. If both instances ran on the same ESX
host, only one of their consoles would be available. However, that console
would be presented when requested for both instances. This has been fixed
so that the nova VMware driver now allocates VNC ports which are unique to
a vcenter, and a user of one instance will not be presented with the
console of another. (BZ#1077017)

Enhancement:

* When troubleshooting production systems it is desirable to be able to
trace all data base queries, web REST calls, messaging service RPC calls,
and libvirt API calls associated with invocation of a user command or
background job. Hence, the ability has been added to obtain a debug dump of
the system state for an OpenStack service based process. For example, upon
sending SIGUSR1, a dump of all native threads, green threads, live
configuration, and any other relevant info is triggered. (BZ#1071469)

All openstack-nova users are advised to upgrade to these updated packages,
which correct these issues and add this enhancement.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Updated packages

Red Hat OpenStack 4.0

SRPMS:
openstack-nova-2013.2.3-7.el6ost.src.rpm
File outdated by:  RHSA-2014:1689
    MD5: 2bb3528799f89079d173a411feb5c701
SHA-256: 22b5fda8c06debe93bd7bfbc1abb11b65d444bad9f6937f0cb9c7b6c59cc8dc0
 
x86_64:
openstack-nova-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: f7499e5901fd055f1c6645cb1fac79b5
SHA-256: 07a6386725a42c43f87720ef9566bdd9679fde878a26213f5467fc7a1d701952
openstack-nova-api-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: fe1220a6b6ac10f4be10b149fde7cc8f
SHA-256: 78a361ad8277a5b37dd1d75663b446d4a1d724324a433edc52cf0f30d9efdaf8
openstack-nova-cells-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: b0fb31b587fdee787627140e60ead3f8
SHA-256: 5a2d39ae64c23d31d0aa1ec487da5e702443d46bc13c315058f67a221f33141c
openstack-nova-cert-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: 860cfd3ead11d82ad7cbe67cf0e62f1c
SHA-256: 07c2b2d8c5515741b7127ab0a5c851d5deeb79483bebb0a4975565bb3ecaed8b
openstack-nova-common-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: 05e179a202cb7743cd1013a1380134d1
SHA-256: b734b387c51c698aace43768bb54c0659c88a8e620f000f936eab7456f106ecf
openstack-nova-compute-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: bd447ed019240a53ba55e4e30b756506
SHA-256: 34f2ceb3e8228945c5dd29ec407ea2ed6faed1645bdd5ff676d360f2ceabdcd2
openstack-nova-conductor-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: f660f0d05ad7391650e5093c713d6eb0
SHA-256: ab15989736fafc9b098440597f32a8ebaeb1dea0ba27d76c5e18748cd70cf51a
openstack-nova-console-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: dacf3a5ef537760437c368f2c4efa584
SHA-256: 8d5178bac4e4479da470f7579bd560d92614cd63198c46a9d9cf843593cb0c5a
openstack-nova-doc-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: a99696bd93c2bb0172b5295d968571ce
SHA-256: 2e248ddb9fe30a3546b80e62f52097b98e54dd362edf725d1bcd20515da9ad1f
openstack-nova-network-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: bb7baab4c20e42094ea0af0b2665bd43
SHA-256: 2ac913e4dd3bc18418788ac7aad081dc8a998abf6b21daf82040a0c350a24f31
openstack-nova-novncproxy-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: 7ba81c22af93f61a5336e4e7c15bd70f
SHA-256: 794956c33dcff39105996cb7c6ef6a62ad5a21dc9926cf1dbba07bc7b47776da
openstack-nova-objectstore-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: d6cd7f69a1675082758f48c19ac4c15f
SHA-256: f781d7aa015850b5b1779a53ffad793cda79a0b5bf6c64e92f1e2f98bb33a430
openstack-nova-scheduler-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: a6c46849c50ff4df0e36306fe83698f0
SHA-256: b1fd647f46fec383d14b4b601a325049ba2771500afa303927b35c9e7a6d97c0
python-nova-2013.2.3-7.el6ost.noarch.rpm
File outdated by:  RHSA-2014:1689
    MD5: 1d51c8a4c06ead7c1f3d14a2a2c93b39
SHA-256: 6fe1d3b98ecf80c9e1b164d78865d3ad19d0261e83df70daed33cad0fa1854d4
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1022627 - stale qemu processes left running in nova due to incorrect libguestfs cleanup
1060772 - nova qpid reconnection delay must be more accurate
1069429 - VMware: delete vm snapshot after nova snapshot
1069432 - VMware: iscsi target discovery fails while attaching volumes
1071469 - [RFE][nova]: Provide for a live debug dump of system state
1077017 - VMware: fix the VNC port allocation
1078002 - CVE-2014-0134 openstack-nova: Nova host data leak to vm instance in rescue mode
1081001 - Need to allow disabling of bandwidth polling periodic task
1085005 - openstack-nova: several instances are able to be configure the same bootable volume
1089070 - Depend on sufficiently new version of libvirt


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/