CVE-2014-5356

What it actually does

The V2 API in Glance fails to enforce the image_size_cap setting, allowing authenticated users to upload images of arbitrary size that consume disk storage without limit.

Why it matters to the business

Storage exhaustion can render the image service unavailable, disrupt virtual machine provisioning and operations across OpenStack deployments, and require manual cleanup or restarts to recover capacity.

How an attack unfolds

An authenticated user obtains API credentials, then uses the Glance V2 API to upload an image file larger than the configured cap; the missing enforcement check allows the upload to complete and persist on disk until storage is depleted.

How to fix it

Upgrade Glance to 2013.2.4, 2014.1.3, Juno-3 or later releases that correctly enforce image_size_cap; additionally restrict V2 API access to trusted accounts and monitor storage quotas.

How to confirm the fix worked

After upgrade, attempt an upload exceeding the configured cap and confirm the request is rejected with an appropriate error; review Glance logs for size-cap enforcement messages and verify disk usage remains bounded.

Typical attack path

1. Obtain valid authentication token for an OpenStack tenant
2. Issue POST /v2/images request via the Glance V2 API with an oversized image payload
3. Repeat uploads to accelerate disk consumption and trigger denial of service

How to detect it

Search Glance API and registry logs for V2 image-create or upload events with unusually large byte counts; correlate with rapid increases in glance image store disk utilization or quota-exhaustion errors.

• POST /v2/images.*Content-Length: [0-9]{10,}
• glance.registry.*image_size_cap bypassed
• disk consumption alert from glance image directory

What your security team should do

• Apply the listed fixed versions to all Glance deployments immediately
• Audit and tighten V2 API permissions to least-privilege accounts
• Implement storage quota alerts and periodic capacity reviews