CVE-2013-4469 OpenStack Compute (Nova) Denial of service due to improper validation of virtual size of QCOW2 image

What is CVE-2013-4469?

CVE-2013-4469 is a low-severity denial of service vulnerability in n/a, published on 2 Nov 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.

Weakness: CWE-399

Which versions are affected by CVE-2013-4469?

3 open source packages ship an affected version, including nova. It affects 3 products.

Products include Openstack Folsom, Openstack Grizzly, Openstack Havana.

How do I fix CVE-2013-4469?

Upgrade nova to 12.0.0a0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-4469 being exploited?

There is no known exploitation of CVE-2013-4469 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2013-2161 OpenStack Swift Unchecked user input in XML responses High 7.5
• CVE-2013-4497 OpenStack Compute Nova Improper Access Control Medium 6.4
• CVE-2013-1665 XML External Entity (XXE) in Django Medium 5.0
• CVE-2012-3447 Arbitrary file overwrite in OpenStack Nova Medium 4.9
• CVE-2012-5625 OpenStack Nova Information leak in libvirt LVM-backed instances Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-4469, GHSA-2w87-5qcj-j6gx, PYSEC-2026-860.