[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 11 Jul 2012 18:43:07 +0200
From: Thierry Carrez <thierry@...nstack.org>
To: "openstack@...ts.launchpad.net" <openstack@...ts.launchpad.net>,
oss-security@...ts.openwall.com
Subject: [OSSA 2012-009] Scheduler denial of service through scheduler_hints
(CVE-2012-3371)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
OpenStack Security Advisory: 2012-009
CVE: CVE-2012-3371
Date: July 11, 2012
Title: Scheduler denial of service through scheduler_hints
Impact: Medium
Reporter: Dan Prince (Red Hat)
Products: Nova
Affects: Essex, Folsom series
Description:
Dan Prince from Red Hat reported a vulnerability in Nova scheduler
nodes. By creating servers with malicious scheduler_hints, an
authenticated user may generate a huge amount of database calls,
potentially resulting in a Denial of Service attack against Nova
scheduler nodes. Only setups exposing the OpenStack API and enabling
DifferentHostFilter and/or SameHostFilter are affected.
Fixes:
Folsom:
https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d
Essex:
https://github.com/openstack/nova/commit/25f5bd31805bd21d7b7e3583c775252aa8f737e9
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3371
https://bugs.launchpad.net/nova/+bug/1017795
Notes:
This fix will be included in the folsom-3 development milestone
(published next month) and in future Essex releases.
- --
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBCAAGBQJP/a0VAAoJEFB6+JAlsQQjRdIP/3jbLZFlixAbH6IXGlcXPnDj
CFPTKo+cCbKjRWarbY738O17M4mYrFRnSq+o6tsQ4+YAgHtEtsSsAhimJ49y1H6G
uQo8KURudVEiZ/ues2GJl4fQuEhRHCBaBhvCqIkhlY3s3OnvCzLGVWTQs48y8SdY
7o4PyV7zwMugidiugEwW3DxtzOQyPNrt0y5KuWem1QTc+ODSPRyfxEp0FpPoZ6Hj
t6C+E3mZ1FNO119W+IjhhSJjEiyeg0pEZeCeqQaapoSRbwZXiCo/qPOuE9KQD2oW
jgnZ21HmMAQC5YsOLwuRL6/1Ht/Yl/TBF0oVRPTh9T7+Lfzp2y1dXwVlmwOzjnVO
3nWA5l9Kuk7lOOjsQCzxCVSH92QyBfR+9XdDzRqDZzBF+tpq/5rI7qCzcpz+4RMM
UH+6tvdB0Nye/eH0m8RP0HcxTEpM+1uPP/YDVWcP3IB9tLG9YAT6ZfGYf95N12kS
tyqxklt952vgTEHqXqkW4as2bx0E8oigHRzGEWCCmtaMGs1QmM70p0Q1rC/QNyOp
ZX63yj9eldl7wn9VUV03Ixe29qWrPLrpLg4gYEu4V53II0+9vmzHMTzWrQR4/HGw
jgnwu4/OPEvpiN67fOUWLa6ZbX4XxBomwCD+CzJUblcWT19ukJKCrFLLYYq5m+PQ
OZnFoLBQnTXPwWi+URXo
=pIZB
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
