OpenStack Compute (nova)

  1. Bug #1031311
  2. Comment #0

Comment 0 for bug 1031311

Revision history for this message
Pádraig Brady (p-draigbrady) wrote : CVE-2012-3361 not fully addressed

Unfortunately the patches released for bug 1015531, didn't consider permissions in the guest.
If there is a root only readable directory in the guest containing the dodgy symlinks,
then they will not be detected by _join_and_check_path_within_fs()
Therefore the equivalent of this function needs to run as the root user.

Folsom patch attached.
Diablo & Essex versions would need readlink added to rootwrap