Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 6 Oct 2016 19:43:01 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2016-012] Malicious qemu-img input may exhaust resources in
 Cinder, Glance, Nova (CVE-2015-5162)

================================================================
OSSA-2016-012: Malicious qemu-img input may exhaust resources in
Cinder, Glance, Nova
================================================================

:Date: October 06, 2016
:CVE: CVE-2015-5162


Affects
~~~~~~~
- Cinder: <=7.0.2, >=8.0.0 <=8.1.1
- Glance: <=11.0.1, ==12.0.0
- Nova: <=12.0.4, ==13.0.0


Description
~~~~~~~~~~~
Richard W.M. Jones of Red Hat reported a vulnerability that affects
OpenStack Cinder, Glance and Nova. By providing a maliciously
crafted disk image an attacker can consume considerable amounts of
RAM and CPU time resulting in a denial of service via resource
exhaustion. Any project which makes calls to qemu-img without
appropriate ulimit restrictions in place is affected by this flaw.


Patches
~~~~~~~
- https://review.openstack.org/382573 (cinder) (Liberty)
- https://review.openstack.org/378012 (glance) (Liberty)
- https://review.openstack.org/327624 (nova) (Liberty)
- https://review.openstack.org/375625 (cinder) (Mitaka)
- https://review.openstack.org/377736 (glance) (Mitaka)
- https://review.openstack.org/326327 (nova) (Mitaka)
- https://review.openstack.org/375102 (cinder) (Newton)
- https://review.openstack.org/377734 (glance) (Newton)
- https://review.openstack.org/307663 (nova) (Newton)
- https://review.openstack.org/375099 (cinder) (Ocata)
- https://review.openstack.org/375526 (glance) (Ocata)


Credits
~~~~~~~
- Richard W.M. Jones from Red Hat (CVE-2015-5162)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1449062
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5162


Notes
~~~~~
- Separate Ocata patches are listed for Cinder and Glance, as they
  were fixed during the Newton release freeze after it branched from
  master.


-- 
Jeremy Stanley
OpenStack Vulnerability Management Team

Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.