Bug 1302607 (CVE-2016-0757) - CVE-2016-0757 openstack-glance: Glance image status manipulation through locations
Summary: CVE-2016-0757 openstack-glance: Glance image status manipulation through loca...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0757
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1303233 1303234 1303235 1303236 1303237 1304726 1304727
Blocks: 1302609
TreeView+ depends on / blocked
 
Reported: 2016-01-28 09:13 UTC by Adam Mariš
Modified: 2021-02-17 04:25 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An authorization vulnerability in OpenStack Image service was discovered, which allowed image-status manipulation using locations. By removing the last location of an image, an authenticated user could change the status from 'active' to 'queue'. A malicious tenant could exploit this flaw to silently replace owned image data, regardless of its original creator or visibility settings. Only environments with show_multiple_locations set to true (not default) were affected.
Clone Of:
Environment:
Last Closed: 2016-03-08 21:42:39 UTC
Embargoed:


Attachments (Terms of Use)
Master/mitaka patch (15.79 KB, patch)
2016-01-29 09:38 UTC, Adam Mariš
no flags Details | Diff
Stable/kilo patch (15.93 KB, patch)
2016-01-29 09:39 UTC, Adam Mariš
no flags Details | Diff
Stable/liberty patch (15.92 KB, patch)
2016-01-29 09:39 UTC, Adam Mariš
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0309 0 normal SHIPPED_LIVE Low: openstack-glance security update 2016-02-29 10:09:40 UTC
Red Hat Product Errata RHSA-2016:0352 0 normal SHIPPED_LIVE Low: openstack-glance security update 2016-03-04 00:31:01 UTC
Red Hat Product Errata RHSA-2016:0354 0 normal SHIPPED_LIVE Low: openstack-glance security update 2016-03-04 00:45:25 UTC
Red Hat Product Errata RHSA-2016:0358 0 normal SHIPPED_LIVE Low: openstack-glance security update 2016-03-07 05:58:40 UTC

Description Adam Mariš 2016-01-28 09:13:22 UTC
A vulnerability in Glance was reported, allowing image status manipulation via locations. By removing the last location of an image, an authenticated user can change the image status to queue. This breaks the immutability promise as described in OSSA 2015-019 as the image gets transitioned from active to queued and new image data can be uploaded. Only setup with show_multiple_locations set to true (not default) are affected.

Affected versions are <=2015.1.2, >=11.0.0 and <= 11.0.1.

Comment 1 Adam Mariš 2016-01-28 09:17:37 UTC
Acknowledgments:

Name: the Openstack project
Upstream: Erno Kuvaja (HPE)

Comment 2 Adam Mariš 2016-01-29 09:38:39 UTC
Created attachment 1119384 [details]
Master/mitaka patch

Comment 3 Adam Mariš 2016-01-29 09:39:03 UTC
Created attachment 1119385 [details]
Stable/kilo patch

Comment 4 Adam Mariš 2016-01-29 09:39:24 UTC
Created attachment 1119386 [details]
Stable/liberty patch

Comment 5 Adam Mariš 2016-01-29 09:41:18 UTC
The proposed fix prevents the removal of the last location of an image
so that an active image is always available. This action was previously
incorrectly allowed and the fix might break some users who are relying
on the false assumption that it would be OK to replace the data of
existing image in the special case that the multiple locations has been
configured.

Comment 7 hguemar 2016-02-02 15:09:36 UTC
Taking care of backporting/rebuilding the packages

Comment 9 Tristan Cacqueray 2016-02-03 18:33:02 UTC
Note that the impact description and note have changed slightly, here are the updated version:

Description:
Erno Kuvaja from HPE reported a vulnerability in Glance. By removing the last location of an image, an authenticated user may change the image status back to queued and may be able to upload new image data resulting in a broken Glance’s immutability promise. A malicious tenant may exploit this flaw to silently replace image data it owns, regardless of the original creator or the visibility settings. Only setups with show_multiple_locations enabled (not default) are affected.

Note:
The proposed fix prevents the removal of the last location of an image so that an active image is always available. This action was previously incorrectly allowed and the fix might break some users who are relying on the false assumption that it would be ok to replace the data of existing image in the special case that the multiple locations has been configured.

Comment 10 Martin Prpič 2016-02-04 08:35:35 UTC
Unfortunately the proposed patch contained a couple of mistakes: The stable/kilo was missing an import and may fail with a NameError exception when trying to log an error. The master/mitaka patch python3 unit tests were not able to validate the new HTTPForbidden exceptions.

A new version of those patches are now available here:

https://review.openstack.org/#/c/275735/
https://review.openstack.org/#/c/275737/

Comment 12 Andrej Nemec 2016-02-04 13:23:24 UTC
Created openstack-glance tracking bugs for this issue:

Affects: fedora-all [bug 1304727]

Comment 13 Andrej Nemec 2016-02-04 13:23:50 UTC
Public via:

http://seclists.org/oss-sec/2016/q1/280

Comment 18 errata-xmlrpc 2016-02-29 05:10:01 UTC
This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2016:0309 https://rhn.redhat.com/errata/RHSA-2016-0309.html

Comment 19 errata-xmlrpc 2016-03-03 19:31:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2016:0352 https://rhn.redhat.com/errata/RHSA-2016-0352.html

Comment 20 errata-xmlrpc 2016-03-03 19:47:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7

Via RHSA-2016:0354 https://rhn.redhat.com/errata/RHSA-2016-0354.html

Comment 21 errata-xmlrpc 2016-03-07 00:58:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Via RHSA-2016:0358 https://rhn.redhat.com/errata/RHSA-2016-0358.html


Note You need to log in before you can comment on or make changes to this bug.