CVE-2014-3641

What it actually does

The flaw permits remote authenticated users to read arbitrary file contents from the Cinder-volume host when a volume is cloned and attached using the GlusterFS or Linux Smbfs driver if the volume image contains a malicious qcow2 header.

Why it matters to the business

Organizations running older OpenStack deployments face risk of unauthorized data exposure from storage hosts, potentially resulting in loss of sensitive information and regulatory exposure.

How an attack unfolds

An attacker with valid credentials creates or uploads a volume whose qcow2 header references host filesystem paths, then clones and attaches that volume; the vulnerable driver follows the crafted header and returns host file data to the attacker.

How to fix it

Upgrade OpenStack Cinder to version 2014.1.3 or newer and verify that the GlusterFS and Smbfs volume drivers are no longer present or have been replaced with patched implementations.

How to confirm the fix worked

Confirm the installed Cinder package version is at least 2014.1.3, review volume driver configuration to ensure vulnerable backends are disabled, and test that attaching a crafted qcow2 volume no longer leaks host files.

Typical attack path

1. Obtain valid OpenStack credentials
2. Create or import a volume backed by a qcow2 image containing a malicious backing-file header
3. Clone the volume and attach it to an instance
4. Read the resulting volume contents that expose host filesystem data

How to detect it

Review Cinder volume service logs for attachment or clone operations involving qcow2 images with external backing-file references; correlate with authentication events from the same user accounts.

What your security team should do

• Identify all deployments still running Cinder versions prior to 2014.1.3
• Schedule immediate upgrade of affected Cinder nodes
• Audit existing volumes for unexpected qcow2 backing files
• Restrict volume creation privileges to the minimum required users