Ubuntu.comUB:CVE-2020-17376CVE-2020-17376
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
0.002 Low
EPSS
Percentile
54.2%
An issue was discovered in Guest.migrate in virt/libvirt/guest.py in
OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing
a soft reboot of an instance that has previously undergone live migration,
a user may gain access to destination host devices that share the same
paths as host devices previously referenced by the virtual machine on the
source host. This can include block devices that map to different Cinder
volumes at the destination than at the source. Only deployments allowing
host-based connections (for instance, root and ephemeral devices) are
affected.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | This is only an issue when libvirt is 1.3.4 and later. On Xenial, libvirt is 1.3.1 and is not vulnerable. This is fixed in focal-updates but is not yet in -security |
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
0.002 Low
EPSS
Percentile
54.2%