openshift up to 3.3.1.10/3.2.1.22/3.3 Request resource management

Summaryinfo

A vulnerability, which was classified as problematic, was found in openshift up to 3.3.1.10/3.2.1.22/3.3. The impacted element is an unknown function. The manipulation as part of Request results in resource management. This vulnerability is cataloged as CVE-2016-9592. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in openshift up to 3.3.1.10/3.2.1.22/3.3 (Virtualization Software). Affected is some unknown functionality. The manipulation as part of a Request leads to a resource management vulnerability. CWE is classifying the issue as CWE-399. This is going to have an impact on availability. CVE summarizes:

openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the number of API requests being sent to the cloud-provider exceeds the API's rate-limit.

The bug was discovered 12/16/2016. The weakness was shared 04/16/2018 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability is traded as CVE-2016-9592 since 11/23/2016. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 486 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.3.1.11, 3.2.1.23 or 3.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 94991†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• openshift

Version

• 3.0
• 3.1
• 3.2
• 3.2.1.0
• 3.2.1.1
• 3.2.1.2
• 3.2.1.3
• 3.2.1.4
• 3.2.1.5
• 3.2.1.6
• 3.2.1.7
• 3.2.1.8
• 3.2.1.9
• 3.2.1.10
• 3.2.1.11
• 3.2.1.12
• 3.2.1.13
• 3.2.1.14
• 3.2.1.15
• 3.2.1.16
• 3.2.1.17
• 3.2.1.18
• 3.2.1.19
• 3.2.1.20
• 3.2.1.21
• 3.2.1.22
• 3.3
• 3.3.1.0
• 3.3.1.1
• 3.3.1.2
• 3.3.1.3
• 3.3.1.4
• 3.3.1.5
• 3.3.1.6
• 3.3.1.7
• 3.3.1.8
• 3.3.1.9
• 3.3.1.10

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion