Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 558112 (CVE-2015-3241) - <sys-cluster/nova-2015.1.1-r2: DoS (CVE-2015-3241)
Summary: <sys-cluster/nova-2015.1.1-r2: DoS (CVE-2015-3241)
Status: RESOLVED FIXED
Alias: CVE-2015-3241
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://launchpad.net/bugs/1387543
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-18 22:35 UTC by Matthew Thode ( prometheanfire )
Modified: 2015-11-09 22:21 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-08-18 22:35:52 UTC
Title: Nova instance migration process does not stop when instance is
       deleted
Reporter: George Shuklin (Webzilla LTD)
Products: Nova
Affects: versions through 2014.1.4, and 2014.2 versions through
         2014.2.3, and version 2015.1.0

Description:
George Shuklin from Webzilla LTD reported a vulnerability in Nova
migration process. By resizing and deleting an instance repeatedly an
authenticated user may overcome his quota and overload Nova compute
nodes resulting in a denial of service attack. All Nova setups are affected.


This also effects 2015.1.1 (it wasn't released at the original announce date.

Reproducible: Always
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-08-18 22:37:18 UTC
arches, please stablize the following

=dev-python/oslo-concurrency-1.8.2 (needed as the cve makes use of some added functionality)
=sys-cluster/nova-2015.1.1-r2
Comment 2 Agostino Sarubbo gentoo-dev 2015-08-20 08:36:04 UTC
  dependency.bad [fatal]        28                                                                                                                                                              
   sys-cluster/nova/nova-2015.1.1-r2.ebuild: DEPEND: amd64(default/linux/amd64/13.0)                                                                                                            
[     '>=dev-python/python-ironicclient-0.4.1[python_targets_python2_7(-)?,-python_single_target_python2_7(-)]',                                                                                
      '<dev-python/python-ironicclient-0.6.0[python_targets_python2_7(-)?,-python_single_target_python2_7(-)]']                                                                                 
   sys-cluster/nova/nova-2015.1.1-r2.ebuild: RDEPEND: amd64(default/linux/amd64/13.0)                                                                                                           
['>=sys-block/open-iscsi-2.0.872-r3'] 

Could you update the stable list?
Comment 3 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-08-20 22:08:40 UTC
arches, please stablize the following

=dev-python/oslo-concurrency-1.8.2 (needed as the cve makes use of some added functionality)
=dev-python/python-ironicclient-0.5.1
=sys-block/open-iscsi-2.0.873
=sys-cluster/nova-2015.1.1-r2

think that covers it
Comment 4 Agostino Sarubbo gentoo-dev 2015-08-21 06:41:26 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2015-08-21 06:42:22 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 6 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-08-22 09:00:54 UTC
cleaned up
Comment 7 Stefan Behte (RETIRED) gentoo-dev Security 2015-11-09 22:06:07 UTC
Vote: NO.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2015-11-09 22:20:19 UTC
CVE-2015-3241 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3241):
  OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does
  not stop the migration process when the instance is deleted, which allows
  remote authenticated users to cause a denial of service (disk, network, and
  other resource consumption) by resizing and then deleting an instance.
Comment 9 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-11-09 22:20:57 UTC
GLSA Vote: No