[OSSA 2013-024] nova should check the is_public of flavor when creating an instance

[Ken'ichi Ohmichi]

If creating a flavor with is_public "false", the flavor should be accessible only by admin or user who is granted to access.
Now "get flavor details" API checks the is_public of flavor but "create an instance" API does not check.
In the following case, a user (not admin) cannot access non-public flavor through "get flavor details" API, this is right behavior.
However, he can access non-public flavor through "create an instance" API.

=== admin ==============================================================
$ nova flavor-create --is-public false private-flavor 6 512 0 1
+----+----------------+-----------+------+-----------+------+-------+-------------+-----------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public |
+----+----------------+-----------+------+-----------+------+-------+-------------+-----------+
| 6 | private-flavor | 512 | 0 | 0 | | 1 | 1.0 | False |
+----+----------------+-----------+------+-----------+------+-------+-------------+-----------+
$
$ curl -i http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/flavors/5 -X GET -H "X-Auth-Project-Id: demo" -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: [..]"
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 428
X-Compute-Request-Id: req-53ab8206-f458-441c-a0ca-d17e333f4247
Date: Wed, 14 Aug 2013 09:38:10 GMT

{"flavor": {"name": "m1.xlarge", "links": [{"href": "http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/flavors/5", "rel": "self"}, {"href": "http://192.168.0.30:8774/7a5c62d3cadb40d28e3c25acf7a05b05/flavors/5", "rel": "bookmark"}], "ram": 16384, "OS-FLV-DISABLED:disabled": false, "vcpus": 8, "swap": "", "os-flavor-access:is_public": true, "rxtx_factor": 1.0, "OS-FLV-EXT-DATA:ephemeral": 0, "disk": 160, "id": "5"}}
$

=== user("demo" user on devstack) ==============================================================
$ nova flavor-list
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| 1 | m1.tiny | 512 | 1 | 0 | | 1 | 1.0 | True |
| 2 | m1.small | 2048 | 20 | 0 | | 1 | 1.0 | True |
| 3 | m1.medium | 4096 | 40 | 0 | | 2 | 1.0 | True |
| 4 | m1.large | 8192 | 80 | 0 | | 4 | 1.0 | True |
| 42 | m1.nano | 64 | 0 | 0 | | 1 | 1.0 | True |
| 5 | m1.xlarge | 16384 | 160 | 0 | | 8 | 1.0 | True |
| 84 | m1.micro | 128 | 0 | 0 | | 1 | 1.0 | True |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
$
$ curl -i http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/flavors/6 -X GET -H "X-Auth-Project-Id: demo" -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: [..]"
HTTP/1.1 404 Not Found
Content-Length: 78
Content-Type: application/json; charset=UTF-8
X-Compute-Request-Id: req-a7ac7e99-6d29-4893-97a7-6705083739df
Date: Wed, 14 Aug 2013 09:36:52 GMT

{"itemNotFound": {"message": "The resource could not be found.", "code": 404}}
$
$ curl -i http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/servers -X POST -H "X-Auth-Project-Id: demo" -H "User-Agent: python-novaclient" -H "Content-Type: application/json" -H "Accept: application/json" -H "X-Auth-Token: [..]" -d '{"server": {"min_count": 1, "flavorRef": "6", "name": "test-not-public", "imageRef": "428f795d-01b0-44c8-a162-9ad86d1fea35", "max_count": 1}}'
HTTP/1.1 202 Accepted
Location: http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/servers/91407b32-7ed1-4108-9e62-192b3312ff20
Content-Type: application/json
Content-Length: 440
X-Compute-Request-Id: req-7e561044-100a-4d70-8b83-cebd21dca8e2
Date: Wed, 14 Aug 2013 09:41:50 GMT

{"server": {"security_groups": [{"name": "default"}], "OS-DCF:diskConfig": "MANUAL", "id": "91407b32-7ed1-4108-9e62-192b3312ff20", "links": [{"href": "http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/servers/91407b32-7ed1-4108-9e62-192b3312ff20", "rel": "self"}, {"href": "http://192.168.0.30:8774/7a5c62d3cadb40d28e3c25acf7a05b05/servers/91407b32-7ed1-4108-9e62-192b3312ff20", "rel": "bookmark"}], "adminPass": "xvFhTwd3yAzE"}}
$ nova list
+--------------------------------------+-----------------+--------+------------+-------------+------------------+
| ID | Name | Status | Task State | Power State | Networks |
+--------------------------------------+-----------------+--------+------------+-------------+------------------+
| 91407b32-7ed1-4108-9e62-192b3312ff20 | test-not-public | ACTIVE | None | Running | private=10.0.0.3 |
+--------------------------------------+-----------------+--------+------------+-------------+------------------+
$

[Jeremy Stanley (fungi)]

Since the other instance of this problem resulted in issuing an advisory (OSSA 2013-019), I'm assuming this one warrants one as well. Opinions?

[Thierry Carrez (ttx)]

I suspect you are right.

[Russell Bryant (russellb)]

Can you confirm that you're testing with a version that includes the fix for OSSA 2013-019 ? This sounds like a duplicate to me.

[Thierry Carrez (ttx)]

According to Russell that looks like a duplicate for bug 1194093, rather than a continuation: instance-create was fixed in OSSA 2013-019.

Ken'ichi Ohmichi: Could you check that you can reproduce the issue with current master branch ? Or one with http://github.com/openstack/nova/commit/b65d506a5f9d9b2b20777a9aceb44a8ffed6a5de in ?

[Ken'ichi Ohmichi (oomichi)]

> Can you confirm that you're testing with a version that includes the fix for OSSA 2013-019 ?
> This sounds like a duplicate to me.

I have confirmed my environment including OSSA 2013-019(commit-id: b65d506a5f9d9b2b20777a9aceb44a8ffed6a5de).
On the environment, this problem happens.

Please see the part "user("demo" user on devstack)" of this report.
"show flavor" API (curl -i http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/flavors/6 -X GET) returns HTTP404 against not-public flavor.
However, "create instance" API (curl -i http://192.168.0.30:8774/v2/7a5c62d3cadb40d28e3c25acf7a05b05/servers -X POST) returns HTTP202, not 404.

This problem is related to OSSA 2013-019.
The commit (b65d506a5f9d9b2b20777a9aceb44a8ffed6a5de) fixes "list flavors" and "show flavor" APIS, but it does not include "create instance" API.

[Ken'ichi Ohmichi (oomichi)]

Hi Russell,

One more thing.
We need to port the patch of OSSA 2013-019(commit-id: b65d506a5f9d9b2b20777a9aceb44a8ffed6a5de) to nova v3 tree.
I have posted the patch for doing it, I am happy if you review it. (https://review.openstack.org/#/c/41843/)

[Russell Bryant (russellb)]

At first I thought I couldn't reproduce this, but I was only trying with novaclient. With novaclient, it looks like it doesn't work. It actually fails on trying to get flavor details and doesn't make it far enough to try to boot the server. So, it does appear there is a problem here.

$ . openrc admin

$ nova flavor-create test2 8 512 4 2 --is-public False
+----+-------+-----------+------+-----------+------+-------+-------------+-----------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public |
+----+-------+-----------+------+-----------+------+-------+-------------+-----------+
| 8 | test2 | 512 | 4 | 0 | | 2 | 1.0 | False |
+----+-------+-----------+------+-----------+------+-------+-------------+-----------+

$ nova flavor-list --all
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| 1 | m1.tiny | 512 | 1 | 0 | | 1 | 1.0 | True |
| 2 | m1.small | 2048 | 20 | 0 | | 1 | 1.0 | True |
| 3 | m1.medium | 4096 | 40 | 0 | | 2 | 1.0 | True |
| 4 | m1.large | 8192 | 80 | 0 | | 4 | 1.0 | True |
| 42 | m1.nano | 64 | 0 | 0 | | 1 | 1.0 | True |
| 5 | m1.xlarge | 16384 | 160 | 0 | | 8 | 1.0 | True |
| 8 | test2 | 512 | 4 | 0 | | 2 | 1.0 | False |
| 84 | m1.micro | 128 | 0 | 0 | | 1 | 1.0 | True |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+

$ . openrc demo

$ nova flavor-list --all
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| ID | Name | Memory_MB | Disk | Ephemeral | Swap | VCPUs | RXTX_Factor | Is_Public |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+
| 1 | m1.tiny | 512 | 1 | 0 | | 1 | 1.0 | True |
| 2 | m1.small | 2048 | 20 | 0 | | 1 | 1.0 | True |
| 3 | m1.medium | 4096 | 40 | 0 | | 2 | 1.0 | True |
| 4 | m1.large | 8192 | 80 | 0 | | 4 | 1.0 | True |
| 42 | m1.nano | 64 | 0 | 0 | | 1 | 1.0 | True |
| 5 | m1.xlarge | 16384 | 160 | 0 | | 8 | 1.0 | True |
| 84 | m1.micro | 128 | 0 | 0 | | 1 | 1.0 | True |
+----+-----------+-----------+------+-----------+------+-------+-------------+-----------+

$ nova boot --flavor 8 --image 899f3f21-e3eb-41b2-b9b9-e805e1ec1e02 test
ERROR: No flavor with a name or ID of '8' exists.

$ curl -i http://162.209.53.10:8774/v2/c7708d0551034f97b1c5fceb848cfcf1/servers -X POST -H "X-Auth-Project-Id: demo"...

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/42922
Committed: http://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9
Submitter: Jenkins
Branch: master

commit 4054cc4a22a1fea997dec76afb5646fd6c6ea6b9
Author: Russell Bryant <email address hidden>
Date: Tue Aug 20 11:06:12 2013 -0400

    Enforce flavor access during instance boot

    The code in the servers API did not pass the context when retrieving
    flavor details. That means it would use an admin context instead,
    bypassing all flavor access control checks.

    This patch includes the fix, and the corresponding unit test, for both
    the v2 and v3 APIs.

    Closes-bug: #1212179

    Change-Id: I681ae9965e19767df22fa74c3315e4e03a459d3b

[Ken'ichi Ohmichi (oomichi)]

Too fast fixing, thanks!

[Thierry Carrez (ttx)]

Russell: could you backport the fix for Folsom/Grizzly (if they are affected as well) ?

Proposed Impact description:
=========================
Title: Resource limit circumvention in Nova private flavors
Reporter: Ken'ichi Ohmichi (NEC)
Products: Nova
Affects: All versions

Description:
Ken'ichi Ohmichi from NEC reported that the fix for OSSA 2013-019 (CVE-2013-2256) was incomplete. Any tenant was still able to boot any other tenant's private flavors by guessing a flavor ID. This potentially allowed circumvention of any resource limits enforced through the os-flavor-access:is_public property.
=========================

[Thierry Carrez (ttx)]

I suspect we can reuse the same CVE. Asking the CNA for confirmation.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/grizzly
Review: https://review.openstack.org/43281

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/folsom
Review: https://review.openstack.org/43296

[Thierry Carrez (ttx)]

Please review impact statement

[Thierry Carrez (ttx)]

This was assigned CVE-2013-4278

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/43296
Committed: http://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492
Submitter: Jenkins
Branch: stable/folsom

commit 6825959560e06725d26625fd21f5c0b78b305492
Author: Russell Bryant <email address hidden>
Date: Tue Aug 20 11:06:12 2013 -0400

    Enforce flavor access during instance boot

    The code in the servers API did not pass the context when retrieving
    flavor details. That means it would use an admin context instead,
    bypassing all flavor access control checks.

    This patch includes the fix, and the corresponding unit test for the v2
    API.

    Closes-bug: #1212179

    (cherry picked from commit 4054cc4a22a1fea997dec76afb5646fd6c6ea6b9)

    Conflicts:
     nova/api/openstack/compute/plugins/v3/servers.py
     nova/api/openstack/compute/servers.py
     nova/tests/api/openstack/compute/plugins/v3/test_servers.py
     nova/tests/api/openstack/compute/test_servers.py

    Change-Id: I681ae9965e19767df22fa74c3315e4e03a459d3b

[Russell Bryant (russellb)]

The description is fine, thanks!

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/43281
Committed: http://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495
Submitter: Jenkins
Branch: stable/grizzly

commit 8b686195afe7e6dfb46c56c1ef2fe9c993d8e495
Author: Russell Bryant <email address hidden>
Date: Tue Aug 20 11:06:12 2013 -0400

    Enforce flavor access during instance boot

    The code in the servers API did not pass the context when retrieving
    flavor details. That means it would use an admin context instead,
    bypassing all flavor access control checks.

    This patch includes the fix, and the corresponding unit test for the v2
    API.

    Closes-bug: #1212179

    (cherry picked from commit 4054cc4a22a1fea997dec76afb5646fd6c6ea6b9)

    Conflicts:
     nova/api/openstack/compute/plugins/v3/servers.py
     nova/api/openstack/compute/servers.py
     nova/tests/api/openstack/compute/plugins/v3/test_servers.py
     nova/tests/api/openstack/compute/test_servers.py

    Change-Id: I681ae9965e19767df22fa74c3315e4e03a459d3b