PT-2013-3539 · Openstack · Openstack Compute

Published 2013-07-09 · Updated 2022-05-17 · CVE-2013-2096

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue allows local users to cause a denial of service by creating an image with a large virtual size that does not contain a large amount of data, resulting in host file system disk consumption.

Recommendations For versions Folsom through Havana, consider restricting the creation of QCOW2 images or implementing size verification to prevent excessive disk consumption until a proper fix is applied.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-399

Related Identifiers

CVE-2013-2096

GHSA-M674-HMX2-FFHQ

Affected Products

Openstack Compute

References · 15

• http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2096 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2096 · Vendor Advisory
• http://ubuntu.com/usn/USN-1831-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2096 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2096 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m674-hmx2-ffhq · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/44a8aba1d5da87d54db48079103fdef946666d80 · Note
• https://github.com/openstack/nova/commit/0caeb8eaf20abcdc77828f5c6b79fc104619e231 · Note
• https://web.archive.org/web/20130726040108/http://securityfocus.com/bid/59924 · Note
• http://securityfocus.com/bid/59924 · Note
• https://review.openstack.org/#/c/28901 · Note
• https://review.openstack.org/#/c/29192 · Note
• https://review.openstack.org/#/c/28717 · Note