Ubuntu Security Notice 1831-2 - USN-1831-1 fixed a vulnerability in OpenStack Nova. The upstream fix introduced a regression where instances using uncached QCOW2 images would fail to start. This update fixes the problem. Loganathan Parthipan discovered that Nova did not verify the size of QCOW2 instance storage. An authenticated attacker could exploit this to cause a denial of service by creating an image with a large virtual size with little data, then filling the virtual disk. Various other issues were also addressed.
a50ab4b4de6a17a5bf675ce2e2d8f1ac4f8d0e30adadd5f88dc4ecf39fa42552
==========================================================================
Ubuntu Security Notice USN-1831-2
May 29, 2013
nova regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
Summary:
USN-1831-1 introduced a regression in OpenStack Nova.
Software Description:
- nova: OpenStack Compute cloud infrastructure
Details:
USN-1831-1 fixed a vulnerability in OpenStack Nova. The upstream fix
introduced a regression where instances using uncached QCOW2 images would
fail to start. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Loganathan Parthipan discovered that Nova did not verify the size of QCOW2
instance storage. An authenticated attacker could exploit this to cause a
denial of service by creating an image with a large virtual size with
little data, then filling the virtual disk.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
python-nova 2012.2.3-0ubuntu2.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1831-2
http://www.ubuntu.com/usn/usn-1831-1
https://launchpad.net/bugs/1183606
Package Information:
https://launchpad.net/ubuntu/+source/nova/2012.2.3-0ubuntu2.2