Bug 1043106 (CVE-2013-6437)

Summary: CVE-2013-6437 openstack-nova: DoS through ephemeral disk backing files
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aortega, apevec, ayoung, chrisw, gkotton, gmollett, iheim, lhh, markmc, ndipanov, rbryant, sclewis, security-response-team, yeylon
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-07-15 06:18:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1063638, 1119584, 1119585, 1119586    
Bug Blocks: 1023240, 1043107    
Attachments:
Description Flags
grizzly patch
none
havana patch
none
icehouse patch none

Description Vincent Danen 2013-12-13 23:23:27 UTC 
Thierry Carrez of the OpenStack project reports:


Title: Nova compute DoS through ephemeral disk backing files
Reporter: Phil Day (HP)
Products: Nova
Affects: All supported versions

Description:
Phil Day from HP reported a vulnerability in the libvirt driver handling
of ephemeral disk backing files on Nova compute nodes. By repeatedly
creating snapshots, changing the os_type to a new random value, and
spawning new instances from the snapshot (and quickly deleting those
instances), an authenticated user could generate lots of different
ephemeral disk backing files and fill up compute node disks, potentially
resulting in a Denial of Service against a Nova setup. Only Nova setups
running the libvirt driver are affected.


CVE-2013-6437 has been assigned to identify this flaw.


Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Phil Day from HP as the original reporter.
Comment 2 Vincent Danen 2013-12-13 23:31:17 UTC 
Created attachment 836520 [details]
grizzly patch
Comment 3 Vincent Danen 2013-12-13 23:33:25 UTC 
Created attachment 836521 [details]
havana patch
Comment 4 Vincent Danen 2013-12-13 23:34:19 UTC 
Created attachment 836523 [details]
icehouse patch
Comment 6 errata-xmlrpc 2014-03-04 19:04:35 UTC 
This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:0231 https://rhn.redhat.com/errata/RHSA-2014-0231.html
Comment 7 Garth Mollett 2014-07-15 06:11:12 UTC 
Trackers were never added for fedora/rdo when this was unembargoed. It's almost certainly been fixed in a rebase since then but filing anyway.
Comment 8 Garth Mollett 2014-07-15 06:16:36 UTC 
Statement:

Red Hat Product Security has rated this issue as having moderate security impact in Red Hat OpenStack Platform 3.0. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 10 Garth Mollett 2014-07-15 06:18:02 UTC 
Created openstack-nova tracking bugs for this issue:

Affects: fedora-all [bug 1119584]
Affects: epel-6 [bug 1119585]