OpenStack Nova CVE-2017-18191 Local Denial of Service Vulnerability
by CIRT Team
Description: An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.
Impact: Attackers can exploit this issue to cause denial-of-service conditions.
OpenStack Nova 15.x through 15.1.0 and 16.x through 16.0.4 are vulnerable.
Mitigation: Updates are available. Please see the references or vendor advisory for more information.
Reference URL’s:
- https://review.openstack.org/#/c/539893/
- https://bugs.launchpad.net/nova/+bug/1739593
- https://access.redhat.com/security/cve/cve-2017-18191
- https://bugzilla.redhat.com/show_bug.cgi?id=1546937
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18191
- https://www.securityfocus.com/bid/103104/info
Recommended Posts
Cyber Threat Alert: Surge in Attacks via Compromised Third-Party Service Providers
08 Feb 2024 - Articles, English articles, Security Advisories & Alerts
Subscribe here
MEMBER OF:
