-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing virtual size validation in multiple image processing paths. The patch added 'max_size' parameters and verify_base_size checks to these functions. Pre-patch versions of fetch_to_raw (images.py) and create_image methods (imagebackend.py) lacked these validations, allowing compressed QCOW2 images with large virtual sizes to be processed unchecked. The utils.py fetch_image function's lack of max_size propagation also contributed to the vulnerability. These functions directly handled image ingestion without enforcing size constraints, enabling the disk consumption attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 12.0.0a0 | 12.0.0a0 |