CVE-2013-2096 OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image

What is CVE-2013-2096?

CVE-2013-2096 is a low-severity denial of service vulnerability in n/a, published on 9 Jul 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.

Weakness: CWE-399

Which versions are affected by CVE-2013-2096?

3 open source packages ship an affected version, including nova. It affects 3 products.

Products include Openstack Folsom, Openstack Grizzly, Openstack Havana.

How do I fix CVE-2013-2096?

Upgrade nova to 12.0.0a0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-2096 being exploited?

There is no known exploitation of CVE-2013-2096 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-2161 OpenStack Swift Unchecked user input in XML responses High 7.5
• CVE-2013-4497 OpenStack Compute Nova Improper Access Control Medium 6.4
• CVE-2013-1665 XML External Entity (XXE) in Django Medium 5.0
• CVE-2012-3447 Arbitrary file overwrite in OpenStack Nova Medium 4.9
• CVE-2012-5625 OpenStack Nova Information leak in libvirt LVM-backed instances Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-2096, GHSA-m674-hmx2-ffhq, PYSEC-2026-876.