CVE-2013-1922

2013-04-1500:00:00

ubuntu.com

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:N/A:N

EPSS

0.001

Percentile

31.5%

JSON

qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk
image based on the header, which allows local guest OS administrators to
read arbitrary files on the host by modifying the header to identify a
different format, which is used when the guest is restarted, a different
vulnerability than CVE-2008-2004.

Bugs

Notes

Author	Note
jdstrand	attack is: privileged attacker in the guest that uses a raw image writes data to beginning of device. Later, someone on the host uses qemu-nbd on the attacker-modified image. When the guest is rebooted, the attacker may have access to other files. On Ubuntu, the preferred virtualization management technology is libvirt. As of USN-1008-1, libvirt does not probe the disk format, which reduces this attack to a denial of server for the guest (ie, the attacker-modified image is not usable on reboot). TODO: review use in nova
mdeslaur	patch just introduced new --format option. Default behaviour is still to autodetect. Adding this new option doesn’t fix the issue by itself, so marking as “low” We will not be fixing this issue in Ubuntu 12.04 LTS.

Author

Note

jdstrand

attack is: privileged attacker in the guest that uses a raw image writes data to beginning of device. Later, someone on the host uses qemu-nbd on the attacker-modified image. When the guest is rebooted, the attacker may have access to other files. On Ubuntu, the preferred virtualization management technology is libvirt. As of USN-1008-1, libvirt does not probe the disk format, which reduces this attack to a denial of server for the guest (ie, the attacker-modified image is not usable on reboot). TODO: review use in nova

mdeslaur

patch just introduced new --format option. Default behaviour is still to autodetect. Adding this new option doesn’t fix the issue by itself, so marking as “low” We will not be fixing this issue in Ubuntu 12.04 LTS.