Bug 1405336 (CVE-2016-9592)

Summary:	CVE-2016-9592 openshift: Failing to detach a volume causes DoS by retrying to perform delete
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dbaker, dedgar, dmcphers, eparis, jgoulding, jialiu, jkeck, joelsmith, jokerman, kseifried, lmeyer, mchappel, mmccomas, security-response-team, tdawson, xtian
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openshift 3.3.1.11, openshift 3.2.1.23, openshift 3.4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found where a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the number of API requests being sent to the cloud-provider exceeds the API's rate-limit.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-04 05:47:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1470268
Bug Blocks:	1405337

Description Adam Mariš 2016-12-16 08:53:50 UTC

It was found that when a volume fails to detach for any reason, the delete operation is retried forever, whereas the detach operation does not seem to try to detach more than once. This causes the delete to fail each time with 'VolumeInUse' error. The delete operation occurs every 30 seconds for each volume, which is causing a denial of service as the number of API requests being sent to the cloud-provider exceeds the API's rate-limit.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1404032

Comment 1 Kurt Seifried 2016-12-20 03:17:10 UTC

Changed CVSSv2/3 scores to reflect only a partial DoS rather then a full DoS.

Comment 3 Jason Shepherd 2018-04-04 05:45:33 UTC

This was fixed by a patch to 3.3, and 3.2 here: https://access.redhat.com/errata/RHBA-2017:0199