Bug 1000086 (CVE-2013-4278)

Summary: CVE-2013-4278 OpenStack: Nova private flavors resource limit circumvention incomplete fix for CVE-2013-2256
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, akscram, alexander.sakhnov, aortega, apevec, apevec, asalkeld, ayoung, bfilippov, breu, chrisw, dallan, d.busby, dmoppert, gkotton, hateya, itamar, Jan.van.Eldik, jonathansteffan, jose.castro.leon, lhh, markmc, mlvov, mmagr, ndipanov, p, rbryant, rhos-maint, rkukura, sclewis, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-23 20:14:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 993343, 993412, 994715, 994809, 994810, 1000087, 1000088, 1000089, 1000090, 1000091    
Bug Blocks: 993341    

Description Kurt Seifried 2013-08-22 15:56:15 UTC
Vincent Danen (vdanen) reports:

The previous fix was insufficient and did not fully fix the flaw, as noted here:


The patch to fully correct this flaw is here (I believe it would be in addition to previously-mentioned patches):


Comment 2 Kurt Seifried 2013-08-22 16:01:06 UTC
Created openstack-nova tracking bugs for this issue:

Affects: fedora-all [bug 1000087]
Affects: epel-6 [bug 1000088]

Comment 3 Vincent Danen 2013-08-23 20:14:04 UTC

Not vulnerable.  Red Hat did not release the incomplete fix for CVE-2013-2256 in any products.