CVE-2016-2140

    Dashboard / Vulnerabilities / CVE-2016-2140

    CVE-2016-2140

    Published: 12 Apr 2016Last Modified: 8 Jul 2026

    Summary:

    Details: The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

    References: http://www.openwall.com/lists/oss-security/2016/03/08/6, http://www.securityfocus.com/bid/84277, https://bugs.launchpad.net/nova/+bug/1548450, https://security.openstack.org/ossa/OSSA-2016-007.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6df6ad3ff32f2b1fe2978df1032002548ad8eb66
    Fixed -6fdf1c87b1149e8b395eaa9f4cbf27263cf96ac6

    Affected versions

    12.0.2
    12.0.1
    12.0.0.0rc3
    12.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High