CVE-2015-5162: OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
(updated )
A resource vulnerability in the OpenStack Compute (nova), Block Storage (cinder), and Image (glance) services was found in their use of qemu-img. An unprivileged user could consume as much as 4 GB of RAM on the compute host by uploading a malicious image. This flaw could lead possibly to host out-of-memory errors and negatively affect other running tenant instances. oslo.concurrency has been updated to support process limits (‘prlimit’), which is needed to fix this flaw.
References
- www.openwall.com/lists/oss-security/2016/10/06/8
- access.redhat.com/security/cve/CVE-2015-5162
- bugzilla.redhat.com/show_bug.cgi?id=1268303
- github.com/advisories/GHSA-g2j5-7vgx-6xrx
- github.com/openstack/cinder/commit/455b318ced717fb38dfe40014817d78fbc47dea5
- github.com/openstack/glance/commit/69a9b659fd48aa3c1f84fc7bc9ae236b6803d31f
- github.com/openstack/nova/commit/6bc37dcceca823998068167b49aec6def3112397
- launchpad.net/bugs/1449062
- nvd.nist.gov/vuln/detail/CVE-2015-5162
Code Behaviors & Features
Detect and mitigate CVE-2015-5162 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →