CVE-2013-4463 OpenStack Nova denial of service through compressed disk images

What is CVE-2013-4463?

CVE-2013-4463 is a low-severity denial of service vulnerability in n/a, published on 6 Feb 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.

Weakness: CWE-399

Which versions are affected by CVE-2013-4463?

3 open source packages ship an affected version, including nova. It affects 3 products.

Products include Openstack Folsom, Openstack Grizzly, Openstack Havana.

How do I fix CVE-2013-4463?

Upgrade nova to 12.0.0a0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-4463 being exploited?

There is no known exploitation of CVE-2013-4463 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-2161 OpenStack Swift Unchecked user input in XML responses High 7.5
• CVE-2013-4497 OpenStack Compute Nova Improper Access Control Medium 6.4
• CVE-2013-1665 XML External Entity (XXE) in Django Medium 5.0
• CVE-2012-3447 Arbitrary file overwrite in OpenStack Nova Medium 4.9
• CVE-2012-5625 OpenStack Nova Information leak in libvirt LVM-backed instances Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-4463, GHSA-5644-2v3h-5w4x, PYSEC-2026-865.