Synopsis

Moderate: openstack-nova security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

Updated openstack-nova packages that fix one security issue, several bugs,
and add one enhancement are now available for Red Hat Enterprise Linux
OpenStack Platform 4.0.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

OpenStack Compute (nova) launches and schedules large networks of virtual
machines, creating a redundant and scalable cloud computing platform.
Compute provides the software, control panels, and APIs required to
orchestrate a cloud, including running virtual machine instances, managing
networks, and controlling access through users and projects.

It was found that overwriting the disk inside of an instance with a
malicious image, and then switching the instance to rescue mode, could
potentially allow an authenticated user to access arbitrary files on the
compute host depending on the file permissions and SELinux constraints of
those files. Only setups that used libvirt to spawn instances and which had
the use of cow images disabled ("use_cow_images = False" in nova
configuration) were affected. (CVE-2014-0134)

Red Hat would like to thank the OpenStack Project for reporting this issue.
Upstream acknowledges Stanislaw Pitucha from Hewlett Packard as the
original reporter.

Bug fixes:

• The Compute libguestfs did not perform tear down correctly in certain
  cases, such as when attempting to perform SSH key injection when no SSH
  keys were specified. As a result, libguestfs qemu instances would remain
  running, even after the Compute instance with which they were associated
  was destroyed. This has been fixed and now tear down of libguestfs occurs
  correctly. (BZ#1022627)
  
• Qpid's driver reconnection delay is not configurable. This and the fact
  that the hard-coded delay was quite high became a blocker issue from an HA
  perspective. Making this value configurable is not possible for this
  version, so the hard-coded delay was changed. The new delay cap is 5
  seconds. (BZ#1060772)
  
• Nova was creating a temporary VMware snapshot during a nova snapshot, but
  not deleting it on completion. Thus VMware guests could end up with a large
  number of unnecessary snapshots. The temporary VMware snapshot is now
  deleted on completion of the nova snapshot operation. (BZ#1069429)
  
• The Nova vmware driver was not passing the iscsi server location to the
  instance, hence it was not possible to add a cinder iscsi disk to a VMware
  instance. The nova vmware driver now correctly passes the iscsi server
  location to the instance and it is possible to add a cinder iscsi disk to a
  VMware instance. (BZ#1069432)
  
• The nova VMware driver was assigning VNC ports in a way which could cause
  collisions between guests. There was a small chance that 2 instances could
  be created with the same VNC port. If both instances ran on the same ESX
  host, only one of their consoles would be available. However, that console
  would be presented when requested for both instances. This has been fixed
  so that the nova VMware driver now allocates VNC ports which are unique to
  a vcenter, and a user of one instance will not be presented with the
  console of another. (BZ#1077017)
  

Enhancement:

• When troubleshooting production systems it is desirable to be able to
  trace all data base queries, web REST calls, messaging service RPC calls,
  and libvirt API calls associated with invocation of a user command or
  background job. Hence, the ability has been added to obtain a debug dump of
  the system state for an OpenStack service based process. For example, upon
  sending SIGUSR1, a dump of all native threads, green threads, live
  configuration, and any other relevant info is triggered. (BZ#1071469)
  

All openstack-nova users are advised to upgrade to these updated packages,
which correct these issues and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat OpenStack 4.0 x86_64

Fixes

• BZ - 1022627 - stale qemu processes left running in nova due to incorrect libguestfs cleanup
• BZ - 1060772 - nova qpid reconnection delay must be more accurate
• BZ - 1069429 - VMware: delete vm snapshot after nova snapshot
• BZ - 1069432 - VMware: iscsi target discovery fails while attaching volumes
• BZ - 1071469 - [RFE][nova]: Provide for a live debug dump of system state
• BZ - 1077017 - VMware: fix the VNC port allocation
• BZ - 1078002 - CVE-2014-0134 openstack-nova: Nova host data leak to vm instance in rescue mode
• BZ - 1081001 - Need to allow disabling of bandwidth polling periodic task
• BZ - 1085005 - openstack-nova: several instances are able to be configure the same bootable volume
• BZ - 1089070 - Depend on sufficiently new version of libvirt

CVEs

• CVE-2014-0134

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat OpenStack 4.0

SRPM
openstack-nova-2013.2.3-7.el6ost.src.rpm	SHA-256: 22b5fda8c06debe93bd7bfbc1abb11b65d444bad9f6937f0cb9c7b6c59cc8dc0
x86_64
openstack-nova-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 07a6386725a42c43f87720ef9566bdd9679fde878a26213f5467fc7a1d701952
openstack-nova-api-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 78a361ad8277a5b37dd1d75663b446d4a1d724324a433edc52cf0f30d9efdaf8
openstack-nova-cells-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 5a2d39ae64c23d31d0aa1ec487da5e702443d46bc13c315058f67a221f33141c
openstack-nova-cert-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 07c2b2d8c5515741b7127ab0a5c851d5deeb79483bebb0a4975565bb3ecaed8b
openstack-nova-common-2013.2.3-7.el6ost.noarch.rpm	SHA-256: b734b387c51c698aace43768bb54c0659c88a8e620f000f936eab7456f106ecf
openstack-nova-compute-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 34f2ceb3e8228945c5dd29ec407ea2ed6faed1645bdd5ff676d360f2ceabdcd2
openstack-nova-conductor-2013.2.3-7.el6ost.noarch.rpm	SHA-256: ab15989736fafc9b098440597f32a8ebaeb1dea0ba27d76c5e18748cd70cf51a
openstack-nova-console-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 8d5178bac4e4479da470f7579bd560d92614cd63198c46a9d9cf843593cb0c5a
openstack-nova-doc-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 2e248ddb9fe30a3546b80e62f52097b98e54dd362edf725d1bcd20515da9ad1f
openstack-nova-network-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 2ac913e4dd3bc18418788ac7aad081dc8a998abf6b21daf82040a0c350a24f31
openstack-nova-novncproxy-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 794956c33dcff39105996cb7c6ef6a62ad5a21dc9926cf1dbba07bc7b47776da
openstack-nova-objectstore-2013.2.3-7.el6ost.noarch.rpm	SHA-256: f781d7aa015850b5b1779a53ffad793cda79a0b5bf6c64e92f1e2f98bb33a430
openstack-nova-scheduler-2013.2.3-7.el6ost.noarch.rpm	SHA-256: b1fd647f46fec383d14b4b601a325049ba2771500afa303927b35c9e7a6d97c0
python-nova-2013.2.3-7.el6ost.noarch.rpm	SHA-256: 6fe1d3b98ecf80c9e1b164d78865d3ad19d0261e83df70daed33cad0fa1854d4