openstack team mailing list archive

[Russell Bryant <rbryant@xxxxxxxxxx>]

OpenStack Security Advisory: 2012-005
CVE: 2012-2101
Date: April 19, 2012
Title: No quota enforced on security group rules
Impact: High
Reporter: Dan Prince <dprince@xxxxxxxxxx>
Products: Nova
Affects: All versions

Description:
Dan Prince reported a vulnerability in Nova. He discovered that there
was no limit on the number of security group rules a user can create. By
creating a very large set of rules, an unreasonable number of iptables
rules will be created on compute nodes, resulting in a denial of service.

Fixes:
  Folsom:
https://github.com/openstack/nova/commit/1f644d210557b1254f7c7b39424b09a45329ade7
  2012.1:
https://github.com/openstack/nova/commit/a67db4586f70ed881d65e80035b2a25be195ce64
  2011.3:
https://github.com/openstack/nova/commit/8c8735a73afb16d5856f0aa6088e9ae406c52beb

References:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2101
  https://bugs.launchpad.net/nova/+bug/969545

-- 
Russell Bryant
OpenStack Vulnerability Management Team