CVE-2016-2140

CWE-200 — Information Exposure10 documents8 sources
Severity
5.3MEDIUM
EPSS
0.6%
top 29.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Nova
Timeline
PublishedApr 12
Latest updateMay 14

Description

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDopenstack/nova12.0.0 — 12.0.3+1
▶PyPInova12.0.0 — 12.0.3
▶Debiannova< 2:13.0.0-1+3

Patches

Patch: security.openstack.org ↗Patch: security.openstack.org ↗

🔴Vulnerability Details

4
GHSA
OpenStack Nova host data access through resize/migration↗2022-05-14
▶
OSV
OpenStack Nova host data access through resize/migration↗2022-05-14
▶
OSV
CVE-2016-2140: The libvirt driver in OpenStack Compute (Nova) before 2015↗2016-04-12
▶
CVEList
CVE-2016-2140: The libvirt driver in OpenStack Compute (Nova) before 2015↗2016-04-12
▶

📋Vendor Advisories

3
Ubuntu
OpenStack Nova vulnerabilities↗2017-10-11
▶
Red Hat
openstack-nova: Host data leak through resize/migration↗2016-03-08
▶
Debian
CVE-2016-2140: nova - The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-2140 openstack-nova: Host data leak through resize/migration [fedora-all]↗2016-03-08
▶
Bugzilla
CVE-2016-2140 openstack-nova: Host data leak through resize/migration↗2016-03-01
▶
CVE-2016-2140 (MEDIUM CVSS 5.3) | The libvirt driver in OpenStack Com | cvebase.io