diff options
Diffstat (limited to 'sys-cluster/cinder/files/CVE-2015-1851_2014.2.3.patch')
| -rw-r--r-- | sys-cluster/cinder/files/CVE-2015-1851_2014.2.3.patch | 85 |
1 files changed, 85 insertions, 0 deletions
diff --git a/sys-cluster/cinder/files/CVE-2015-1851_2014.2.3.patch b/sys-cluster/cinder/files/CVE-2015-1851_2014.2.3.patch new file mode 100644 index 000000000000..5335e5c02ad5 --- /dev/null +++ b/sys-cluster/cinder/files/CVE-2015-1851_2014.2.3.patch @@ -0,0 +1,85 @@ +From d31c937c566005dedf41a60c6b5bd5e7b26f221b Mon Sep 17 00:00:00 2001 +From: Eric Harney <eharney@redhat.com> +Date: Tue, 31 Mar 2015 19:48:17 -0400 +Subject: [PATCH] Disallow backing files when uploading volumes to image + +Volumes with a header referencing a backing file can leak +file data into the destination image when uploading a +volume to an image. + +Halt the upload process if the volume data references a +backing file to prevent this. + +Closes-Bug: #1415087 +Change-Id: Iab9718794e7f7e8444015712cfa08c46848ebf78 +(cherry picked from commit 9634b76ba5886d6c2f2128d550cb005dabf48213) +Conflicts: + cinder/tests/test_image_utils.py (backport to old tests) +--- + cinder/image/image_utils.py | 14 ++++++++++++++ + cinder/tests/test_image_utils.py | 13 +++++++++++++ + 2 files changed, 27 insertions(+) + +diff --git a/cinder/image/image_utils.py b/cinder/image/image_utils.py +index 160dfe7..cac0072 100644 +--- a/cinder/image/image_utils.py ++++ b/cinder/image/image_utils.py +@@ -312,6 +312,20 @@ def upload_volume(context, image_service, image_meta, volume_path, + with fileutils.remove_path_on_error(tmp): + LOG.debug("%s was %s, converting to %s" % + (image_id, volume_format, image_meta['disk_format'])) ++ ++ data = qemu_img_info(volume_path) ++ backing_file = data.backing_file ++ fmt = data.file_format ++ if backing_file is not None: ++ # Disallow backing files as a security measure. ++ # This prevents a user from writing an image header into a raw ++ # volume with a backing file pointing to data they wish to ++ # access. ++ raise exception.ImageUnacceptable( ++ image_id=image_id, ++ reason=_("fmt=%(fmt)s backed by:%(backing_file)s") ++ % {'fmt': fmt, 'backing_file': backing_file}) ++ + convert_image(volume_path, tmp, image_meta['disk_format'], + bps_limit=CONF.volume_copy_bps_limit) + +diff --git a/cinder/tests/test_image_utils.py b/cinder/tests/test_image_utils.py +index 86168c0..2cf571a 100644 +--- a/cinder/tests/test_image_utils.py ++++ b/cinder/tests/test_image_utils.py +@@ -462,6 +462,10 @@ def test_upload_volume(self, mock_stat, bps_limit=0): + volume_utils.setup_blkio_cgroup(mox.IgnoreArg(), mox.IgnoreArg(), + bps_limit).AndReturn(prefix) + ++ utils.execute( ++ 'env', 'LC_ALL=C', 'qemu-img', 'info', ++ mox.IgnoreArg(), run_as_root=True).AndReturn( ++ (TEST_RET, 'ignored')) + utils.execute(*cmd, run_as_root=True) + utils.execute( + 'env', 'LC_ALL=C', 'qemu-img', 'info', +@@ -497,6 +501,11 @@ def test_upload_volume_with_bps_limit(self, mock_stat): + + volume_utils.setup_blkio_cgroup(mox.IgnoreArg(), mox.IgnoreArg(), + bps_limit).AndReturn(prefix) ++ ++ utils.execute( ++ 'env', 'LC_ALL=C', 'qemu-img', 'info', ++ mox.IgnoreArg(), run_as_root=True).AndReturn( ++ (TEST_RET, 'ignored')) + utils.execute(*cmd, run_as_root=True) + utils.execute( + 'env', 'LC_ALL=C', 'qemu-img', 'info', +@@ -534,6 +543,10 @@ def test_upload_volume_on_error(self, mock_stat): + m.StubOutWithMock(utils, 'execute') + m.StubOutWithMock(volume_utils, 'check_for_odirect_support') + ++ utils.execute( ++ 'env', 'LC_ALL=C', 'qemu-img', 'info', ++ mox.IgnoreArg(), run_as_root=True).AndReturn( ++ (TEST_RET, 'ignored')) + utils.execute('qemu-img', 'convert', '-O', 'qcow2', + mox.IgnoreArg(), mox.IgnoreArg(), run_as_root=True) + utils.execute( |