OSSA-2013-012: Nova fails to verify image virtual size

OSSA-2013-012: Nova fails to verify image virtual size

Date

May 16, 2013

CVE

CVE-2013-2096

Affects

  • Nova: All versions

Description

Loganathan Parthipan publicly reported a vulnerability in Nova. Nova did not implement checking for the virtual size of a qcow2 image used as ephemeral storage for instances. It is therefore possible for a user to create an image which has a large virtual size, but little data. Once the instance is created, the user can then proceed to fill the virtual disk, and consume all available disk on the host node file system.

Credits

  • Loganathan Parthipan from HP (CVE-2013-2096)

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.