CVE-2015-7548

Severity: low (CVSS 3.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-12 · updated 2026-06-17
Weakness: CWE-200

Description

OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.

Affected products

OpenStack Nova: from 12.0.0 before 12.0.1; from 2015.1.0 before 2015.1.3 — fixed in 12.0.1, 2015.1.3

How to fix

Upgrade to a fixed version: OpenStack Nova 12.0.1, 2015.1.3. Check the vendor advisory for mitigations.

References

http://rhn.redhat.com/errata/RHSA-2016-0018.html
http://www.securityfocus.com/bid/80176
https://security.openstack.org/ossa/OSSA-2016-001.html
http://rhn.redhat.com/errata/RHSA-2016-0018.html
http://www.securityfocus.com/bid/80176
https://security.openstack.org/ossa/OSSA-2016-001.html

Get alerted when CVE-2015-7548 or the next vulnerability affects your stack