{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-01-24T00:00:00", "descriptions": [{"lang": "en", "value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://review.openstack.org/#/c/68659/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://review.openstack.org/#/c/68658/"}, {"name": "65106", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/65106"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://review.openstack.org/#/c/68660/"}, {"name": "openstack-cve20137130-info-disc(90652)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"}, {"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/nova/+bug/1251590"}, {"name": "56450", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/56450"}, {"name": "102416", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/102416"}, {"name": "USN-2247-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2247-1"}, {"name": "RHSA-2014:0231", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"}, {"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"}, {"name": "FEDORA-2014-1463", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"}, {"name": "FEDORA-2014-1516", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-7130", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://review.openstack.org/#/c/68659/", "refsource": "CONFIRM", "url": "https://review.openstack.org/#/c/68659/"}, {"name": "https://review.openstack.org/#/c/68658/", "refsource": "CONFIRM", "url": "https://review.openstack.org/#/c/68658/"}, {"name": "65106", "refsource": "BID", "url": "http://www.securityfocus.com/bid/65106"}, {"name": "https://review.openstack.org/#/c/68660/", "refsource": "CONFIRM", "url": "https://review.openstack.org/#/c/68660/"}, {"name": "openstack-cve20137130-info-disc(90652)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"}, {"name": "https://bugs.launchpad.net/nova/+bug/1251590", "refsource": "MISC", "url": "https://bugs.launchpad.net/nova/+bug/1251590"}, {"name": "56450", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/56450"}, {"name": "102416", "refsource": "OSVDB", "url": "http://osvdb.org/102416"}, {"name": "USN-2247-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2247-1"}, {"name": "RHSA-2014:0231", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"}, {"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"}, {"name": "FEDORA-2014-1463", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"}, {"name": "FEDORA-2014-1516", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T18:01:19.335Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://review.openstack.org/#/c/68659/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://review.openstack.org/#/c/68658/"}, {"name": "65106", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/65106"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://review.openstack.org/#/c/68660/"}, {"name": "openstack-cve20137130-info-disc(90652)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/nova/+bug/1251590"}, {"name": "56450", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/56450"}, {"name": "102416", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/102416"}, {"name": "USN-2247-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2247-1"}, {"name": "RHSA-2014:0231", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"}, {"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"}, {"name": "FEDORA-2014-1463", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"}, {"name": "FEDORA-2014-1516", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-7130", "datePublished": "2014-02-06T16:00:00", "dateReserved": "2013-12-17T00:00:00", "dateUpdated": "2024-08-06T18:01:19.335Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:compute:2012.2:*:*:*:*:*:*:*", "matchCriteriaId": "0E9D8029-F7DD-435D-B4F4-D3DABDB7333B", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*", "matchCriteriaId": "6DE1DE9A-0D08-448B-AF80-7ACA236F2A83", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:compute:2013.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "A1A5AAEB-0A8F-4ECF-B184-6A78B882817A", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:compute:2013.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E8596FDB-87DD-4D06-9923-75EFE7E3F9A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "FA06A9A5-0924-4137-85AF-DB9C7C246DAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*", "matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*", "matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:icehouse:-:*:*:*:*:*:*:*", "matchCriteriaId": "FC112BBD-F3D2-4192-B11A-B99D54B08D99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."}, {"lang": "es", "value": "El m\u00e9todo i_create_images_and_backing (tambi\u00e9n conocido como create_images_and_backing) en el driver libvirt en OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, cuando hace uso de un bloque de migraci\u00f3n KVM en vivo, no crea debidamente todos los archivos esperados, lo que permite a atacantes obtener contenido de una instant\u00e1nea del disco ra\u00edz de otros usuarios a trav\u00e9s del almacenamiento ef\u00edmero."}], "id": "CVE-2013-7130", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.1, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-02-06T17:00:06.977", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/102416"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/56450"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/65106"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2247-1"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/nova/+bug/1251590"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://review.openstack.org/#/c/68658/"}, {"source": "cve@mitre.org", "url": "https://review.openstack.org/#/c/68659/"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://review.openstack.org/#/c/68660/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/102416"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/56450"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/65106"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2247-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.launchpad.net/nova/+bug/1251590"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://review.openstack.org/#/c/68658/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://review.openstack.org/#/c/68659/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://review.openstack.org/#/c/68660/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank OpenStack project for reporting this issue.", "affected_release": [{"advisory": "RHSA-2014:0366", "cpe": "cpe:/a:redhat:openstack:3::el6", "package": "openstack-nova-0:2013.1.5-2.el6ost", "product_name": "OpenStack 3 for RHEL 6", "release_date": "2014-04-03T00:00:00Z"}, {"advisory": "RHSA-2014:0231", "cpe": "cpe:/a:redhat:openstack:4::el6", "package": "openstack-nova-0:2013.2.2-2.el6ost", "product_name": "OpenStack 4 for RHEL 6", "release_date": "2014-03-04T00:00:00Z"}], "bugzilla": {"description": "nova: Live migration can leak root disk into ephemeral storage", "id": "1055400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1055400"}, "csaw": false, "cvss": {"cvss_base_score": "3.5", "cvss_scoring_vector": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "status": "verified"}, "details": ["The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."], "name": "CVE-2013-7130", "public_date": "2014-01-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-7130\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-7130"], "threat_severity": "Moderate"}