0-size images allow unprivileged user to deplete glance resources
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Glance |
Won't Fix
|
Wishlist
|
Unassigned | ||
OpenStack Security Advisory |
Won't Fix
|
Undecided
|
Unassigned | ||
OpenStack Security Notes |
Fix Released
|
Undecided
|
Eric Brown |
Bug Description
Glance allows to create 0-size images ('glance image-create' without parameters). Those images do not consume resources of storage backend and do not hit any limits for size, but take up space in database.
Malicious user can cause database resource depletion with endless flood of 'image-create' requests. Because an empty request is small it will cause more strain on openstack than on the attacker.
RateLimit on API requests allows to delay consequences of attack, but does not prevent it.
Here is simple script to run attack:
while true;do curl -i -X POST -H 'X-Auth-Token: ***' http://
My estimation for database growth is about 1Mb/minute (with extra-slow shell-based attack, but a specially crafted script will allow to run it with RateLimit speed).
description: | updated |
description: | updated |
summary: |
- 0-sized images allow unpriveleged user to deplete glance resources + 0-size images allow unprivileged user to deplete glance resources |
Changed in ossa: | |
status: | New → Incomplete |
Changed in ossn: | |
assignee: | nobody → Grant Murphy (gmurphy) |
Changed in ossn: | |
status: | New → Fix Committed |
Changed in glance: | |
importance: | Undecided → High |
Changed in glance: | |
status: | In Progress → Won't Fix |
importance: | High → Wishlist |
assignee: | Stuart McLaren (stuart-mclaren) → nobody |
Thanks for the report, the OSSA task is set to incomplete pending additional security review from glance-coresec.