CVE-2013-0270: Buffer Overflow
First published: Fri Feb 08 2013(Updated: )
Dan Prince (dprince) reports: When long tenant_name is sent few times when requesting token, responsiveness of service decreases until finally it requests ends with MemoryError. keystoneclient.exceptions.AuthorizationFailure: Authorization Failed: Unable to communicate with identity service: Traceback ... MemoryError Includes whole traceback. Memory on keystone host is used up keystone-all process. Also during processing of the request CPU utilization raises for a long time (when and after the first MemoryError state was reached) - like for more than 10 seconds keystone-all can take whole cpu. Version-Release number of selected component (if applicable): Name : openstack-keystone Arch : noarch Version : 2012.2.1 Release : 3.el6ost How reproducible: Use something similiar to following python example few times (5 times with "len(tenant) == 195000000" for keystone host inside VM with 4GB of RAM) Actual results: For first few tries service correctly responds with: (HTTP 400): Authorization Failed: Request attribute tenantName must be less than or equal to 64. The server could not comply with the request because the attribute size is invalid (too large). The client is assumed to be in error. Later with: (HTTP 500): Authorization Failed: Unable to communicate with identity service: Traceback (most recent call last): ... whole backtrace here MemoryError Most memory of keystone host is used by keystone-all process. Expected results: The first 400 error mentioning that attribute is too big for all request (not only first few). And not such a big impact on memory of host. Additional info: Similiar to <a class="bz_bug_link bz_secure " title="" href="show_bug.cgi?id=906178">bug #906178</a> and so also to related upstream bug <a href="https://bugs.launchpad.net/keystone/+bug/1098307">https://bugs.launchpad.net/keystone/+bug/1098307</a> where they mentioned preparation of general check/defense for too big requests.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Keystone | >=2012.1<=2012.1.3 | |
| OpenStack Keystone | >=2012.2<=2012.2.4 | |
| OpenStack Keystone | =2013.1-milestone1 | |
| OpenStack Keystone | =2013.1-milestone2 | |
| OpenStack Keystone | =2013.1-milestone3 | |
| pip/keystone | <8.0.0a0 | 8.0.0a0 |
| >=2012.1<=2012.1.3 | ||
| >=2012.2<=2012.2.4 | ||
| =2013.1-milestone1 | ||
| =2013.1-milestone2 | ||
| =2013.1-milestone3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=906178
- https://bugs.launchpad.net/keystone/+bug/1098307
- https://bugs.launchpad.net/keystone/+bug/1099025
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=909012#c4
- https://github.com/openstack/keystone/commit/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=909012#c3
- https://review.openstack.org/#/c/22661/
- https://rhn.redhat.com/errata/RHSA-2013-0708.html
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- http://rhn.redhat.com/errata/RHSA-2013-0708.html
- https://launchpad.net/keystone/grizzly/2013.1
- https://nvd.nist.gov/vuln/detail/CVE-2013-0270
- https://github.com/advisories/GHSA-4ppj-4p4v-jf4p (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4ppj-4p4v-jf4p
- alias/CVE-2013-0270
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/openstack
- canonical/openstack keystone
- version/openstack keystone/2012.1
- version/openstack keystone/2012.1.3
- version/openstack keystone/2012.2
- version/openstack keystone/2012.2.4
- version/openstack keystone/2013.1-milestone1
- version/openstack keystone/2013.1-milestone2
- version/openstack keystone/2013.1-milestone3
- package-manager/pip