CVE-2014-9623

Description

A storage quota bypass flaw was found in OpenStack Image (glance). If an image was deleted while it was being uploaded, it would not count towards a user's quota. A malicious user could use this flaw to deliberately fill the backing store, and cause a denial of service.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v2 Score Breakdown

Red HatNVDcve.org
Base Score2.14N/A
Attack VectorNetworkNetworkN/A
Access ComplexityHighLowN/A
AuthenticationSingleSingleN/A
Confidentiality ImpactNoneNoneN/A
Integrity ImpactNoneNoneN/A
Availability ImpactPartialPartialN/A

Vector

Red Hat: AV:N/AC:H/Au:S/C:N/I:N/A:P

NVD: AV:N/AC:L/Au:S/C:N/I:N/A:P

Understanding the Weakness (CWE)

CWE-911

Availability

Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

If an adversary can prevent a reference count from reaching zero, then resources might not be released when they are supposed to, thus causing resources to become scarce for future needs.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If an adversary can cause a reference count to reach zero when the resource is still in use, then a resource might be released before it is supposed to be, possibly forcing an error that causes the product to crash or exit out of its current operation.

Acknowledgements

Red Hat would like to thank OpenStack project for reporting this issue. Upstream acknowledges Tushar Patil (NTT) as the original reporter.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.