QcowFormatInspector feature check checks wrong bitmask
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Cinder |
New
|
Undecided
|
Unassigned | ||
Glance |
New
|
Undecided
|
Unassigned | ||
OpenStack Compute (nova) |
Opinion
|
Undecided
|
Unassigned |
Bug Description
Consider the code at https:/
# This is the maximum byte number we should expect any bits to be set
max_byte = self.I_
# The flag bytes are in big-endian ordering, so if we process
# them in index-order, they're reversed
for i, byte_num in enumerate(
if byte_num == max_byte:
# If we're in the max-allowed byte, allow any bits less than
# the maximum-known feature flag bit to be set
...
if i_features[i] & ~allow_mask:
If I_FEATURES_MAX_BIT is 8 or larger, the allow_mask created for the max_byte is incorrect.
There should be a MOD 8 in the calculation.
As it is, the created allow_mask will have all bits set in the lower 8 bits and allow all bits in the max_byte byte.
By sheer luck, the current value of I_FEATURES_MAX_BIT is only 4, which keeps this from being an active security vulnerability (only a potential one in the future, if this is not fixed before I_FEATURES_MAX_BIT is increased).
description: | updated |
Same at https:/ /opendev. org/openstack/ cinder/ src/branch/ master/ cinder/ image/format_ inspector. py#L328
and
https:/ /opendev. org/openstack/ glance/ src/branch/ master/ glance/ common/ format_ inspector. py#L327