Executive brief
OpenStack Compute (Nova) is the compute service that manages virtual machines in OpenStack clouds. When configured with use_cow_images set to False, Nova fails to properly validate the declared virtual size of QCOW2 disk images, allowing authenticated local users to trigger disk exhaustion on the host system by uploading images with falsely inflated virtual sizes. This can exhaust available storage and disrupt cloud service availability.
Technical details
The vulnerability is an input validation flaw in Nova's QCOW2 image handling. When use_cow_images is disabled, Nova does not verify the virtual size attribute of QCOW2 images downloaded from Glance before allocating disk space, even though the actual image data is much smaller. An attacker with local access can craft a QCOW2 image with a large virtual size declaration that consumes significant host filesystem space during allocation, causing denial of service. The fix involves adding size verification in the image backend's fetch and create_image functions to validate virtual size against a maximum allowed size before proceeding with image download and conversion.
Affected products
- OpenStack Nova Folsom, Grizzly, Havana (before 12.0.0a0)
Timeline
- 2013-11-02: disclosed
- 2013-10-31: patched: Fix committed via multiple patches including 135faa7, 3cdfe89, f6810be
- 2022-05-17: advisory: GHSA-2w87-5qcj-j6gx published