[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20161006194301.GE24597@yuggoth.org>
Date: Thu, 6 Oct 2016 19:43:01 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2016-012] Malicious qemu-img input may exhaust resources in
Cinder, Glance, Nova (CVE-2015-5162)
================================================================
OSSA-2016-012: Malicious qemu-img input may exhaust resources in
Cinder, Glance, Nova
================================================================
:Date: October 06, 2016
:CVE: CVE-2015-5162
Affects
~~~~~~~
- Cinder: <=7.0.2, >=8.0.0 <=8.1.1
- Glance: <=11.0.1, ==12.0.0
- Nova: <=12.0.4, ==13.0.0
Description
~~~~~~~~~~~
Richard W.M. Jones of Red Hat reported a vulnerability that affects
OpenStack Cinder, Glance and Nova. By providing a maliciously
crafted disk image an attacker can consume considerable amounts of
RAM and CPU time resulting in a denial of service via resource
exhaustion. Any project which makes calls to qemu-img without
appropriate ulimit restrictions in place is affected by this flaw.
Patches
~~~~~~~
- https://review.openstack.org/382573 (cinder) (Liberty)
- https://review.openstack.org/378012 (glance) (Liberty)
- https://review.openstack.org/327624 (nova) (Liberty)
- https://review.openstack.org/375625 (cinder) (Mitaka)
- https://review.openstack.org/377736 (glance) (Mitaka)
- https://review.openstack.org/326327 (nova) (Mitaka)
- https://review.openstack.org/375102 (cinder) (Newton)
- https://review.openstack.org/377734 (glance) (Newton)
- https://review.openstack.org/307663 (nova) (Newton)
- https://review.openstack.org/375099 (cinder) (Ocata)
- https://review.openstack.org/375526 (glance) (Ocata)
Credits
~~~~~~~
- Richard W.M. Jones from Red Hat (CVE-2015-5162)
References
~~~~~~~~~~
- https://launchpad.net/bugs/1449062
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5162
Notes
~~~~~
- Separate Ocata patches are listed for Cinder and Glance, as they
were fixed during the Newton release freeze after it branched from
master.
--
Jeremy Stanley
OpenStack Vulnerability Management Team
Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
