[OSSA 2015-004] Image file stays in store if image has been deleted during upload (CVE-2014-9684)

[Mike Fedosin]

When I create a new task in v2 to upload an image, it creates the image record in db, sets status to "saving" and then begins the uploading.

If the image is deleted by appropriate API call while its content is still being uploaded, an exception is raised and it is not handled in the API code. This leads to the fact that the uploaded image file stays in a storage and clogs it.

File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 62, in _execute
uri)
File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 95, in import_image
new_image = image_repo.get(image_id)
File "/opt/stack/glance/glance/api/authorization.py", line 106, in get
image = self.image_repo.get(image_id)
File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
return self.helper.proxy(self.base.get(item_id))
File "/opt/stack/glance/glance/api/policy.py", line 179, in get
return super(ImageRepoProxy, self).get(image_id)
File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
return self.helper.proxy(self.base.get(item_id))
File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
return self.helper.proxy(self.base.get(item_id))
File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
return self.helper.proxy(self.base.get(item_id))
File "/opt/stack/glance/glance/db/__init__.py", line 72, in get raise exception.NotFound(msg)
NotFound: No image found with ID e2285448-a56f-45b1-9e6e-216d2b304967

This bug is very similar to https://bugs.launchpad.net/glance/+bug/1188532, but it relates to task mechanism in v2.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/122427

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/122427
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=7858d4d95154c8596720365e465cca7858cfec5c
Submitter: Jenkins
Branch: master

commit 7858d4d95154c8596720365e465cca7858cfec5c
Author: Mike Fedosin <email address hidden>
Date: Thu Sep 18 18:07:42 2014 +0400

    Initiate deletion of image files if the import was interrupted

    If the image is deleted by appropriate API call while its content
    is still being uploaded in import task in v2, an exception is raised
    and it is not handled in the API code. This leads to the fact that
    the uploaded image file stays in a storage and clogs it.

    There existed code that safely removes image files if the exception
    occurs.

    Change-Id: I4f7d1aa103f4ce7abf4026e7097b9e76c24135fa
    Closes-Bug: 1371118

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/157067

[Nikhil Komawar (nikhil-komawar)]

Thanks for marking Icehouse as Incomplete, Ian. You're right there, the feature did not exist until Juno so it does not affect Icehouse. We can leave it Incomplete so that someone else does not open it up by mistake rather than deleting it.

[Nikhil Komawar (nikhil-komawar)]

- https://review.openstack.org/156553 (Juno)
- https://review.openstack.org/157067 (Juno)
- https://review.openstack.org/156493 (Kilo)
- https://review.openstack.org/122427 (Kilo)

[Tristan Cacqueray (tristan-cacqueray)]

Waiting for https://review.openstack.org/#/c/157067/ to be merged before switching OSSA task to fix released.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/157067
Committed: https://git.openstack.org/cgit/openstack/glance/commit/?id=a880c8e762e94b70c1e5d5692a3defcde734a601
Submitter: Jenkins
Branch: stable/juno

commit a880c8e762e94b70c1e5d5692a3defcde734a601
Author: Mike Fedosin <email address hidden>
Date: Thu Sep 18 18:07:42 2014 +0400

    Initiate deletion of image files if the import was interrupted

    If the image is deleted by appropriate API call while its content
    is still being uploaded in import task in v2, an exception is raised
    and it is not handled in the API code. This leads to the fact that
    the uploaded image file stays in a storage and clogs it.

    There existed code that safely removes image files if the exception
    occurs.

    SecurityImpact

    Conflicts:
     glance/common/scripts/image_import/main.py

    Closes-Bug: 1371118
    Change-Id: I4f7d1aa103f4ce7abf4026e7097b9e76c24135fa
    (cherry picked from commit 7858d4d95154c8596720365e465cca7858cfec5c)