Description: CVE-2013-0208 Disallow boot from arbitrary volumes
 Fix a vulnerability in volume attachment in nova-volume, affecting the
 boot-from-volume feature.  By passing a specific volume ID, an
 authenticated user may be able to boot from a volume they don't own,
 potentially resulting in full access to that 3rd-party volume.
Date: Thu, 24 Jan 2013 10:45:19 +0000
Bug-Debian: http://bugs.debian.org/699266
Bug-Ubuntu: https://launchpad.net/bugs/1069904
Origin: https://github.com/openstack/nova/commit/e28269a34902ba43718622f454341c132fd14995

diff --git a/nova/compute/api.py b/nova/compute/api.py
index f64a10c..633e282 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -390,6 +390,22 @@ class API(BaseAPI):
 
         LOG.debug(_("Going to run %s instances...") % num_instances)
 
+        # Validate the correct devices have been specified
+        for bdm in block_device_mapping:
+            # NOTE(vish): For now, just make sure the volumes are accessible.
+            snapshot_id = bdm.get('snapshot_id')
+            volume_id = bdm.get('volume_id')
+            if volume_id is not None:
+                try:
+                    self.volume_api.get(context, volume_id)
+                except Exception:
+                    raise exception.InvalidBDMVolume(id=volume_id)
+            elif snapshot_id is not None:
+                try:
+                    self.volume_api.get_snapshot(context, snapshot_id)
+                except Exception:
+                    raise exception.InvalidBDMSnapshot(id=snapshot_id)
+
         if create_instance_here:
             instance = self.create_db_entry_for_new_instance(
                     context, instance_type, image, base_options,
diff --git a/nova/exception.py b/nova/exception.py
index 107d926..1f1fa53 100644
--- a/nova/exception.py
+++ b/nova/exception.py
@@ -309,6 +309,20 @@ class InstanceInvalidState(Invalid):
                 "%(method)s while the instance is in this state.")
 
 
+class InvalidBDM(Invalid):
+    message = _("Block Device Mapping is Invalid.")
+
+
+class InvalidBDMSnapshot(InvalidBDM):
+    message = _("Block Device Mapping is Invalid: "
+                "failed to get snapshot %(id)s.")
+
+
+class InvalidBDMVolume(InvalidBDM):
+    message = _("Block Device Mapping is Invalid: "
+                "failed to get volume %(id)s.")
+
+
 class InstanceNotRunning(Invalid):
     message = _("Instance %(instance_id)s is not running.")
 
-- 
1.8.1