CVE-2013-6437

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-06 · updated 2026-06-17
Weakness: CWE-399

Description

The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.

Affected products

OpenStack Nova: from 2013.1 before 2013.1.5; from 2013.2 before 2013.2.2; 2014.1-milestone1 — fixed in 2013.1.5, 2013.2.2

How to fix

Upgrade to a fixed version: OpenStack Nova 2013.1.5, 2013.2.2. Check the vendor advisory for mitigations.

References

http://lists.openstack.org/pipermail/openstack-announce/2013-December/000179.html
http://rhn.redhat.com/errata/RHSA-2014-0231.html
https://bugs.launchpad.net/nova/+bug/1253980
http://lists.openstack.org/pipermail/openstack-announce/2013-December/000179.html
http://rhn.redhat.com/errata/RHSA-2014-0231.html
https://bugs.launchpad.net/nova/+bug/1253980

Get alerted when CVE-2013-6437 or the next vulnerability affects your stack