OpenStack Nova CVE-2017-18191 Local Denial of Service Vulnerability

by CIRT Team

Description: An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.

Impact: Attackers can exploit this issue to cause denial-of-service conditions.

OpenStack Nova 15.x through 15.1.0 and 16.x through 16.0.4 are vulnerable.

Mitigation: Updates are available. Please see the references or vendor advisory for more information.

Reference URL’s:

• https://review.openstack.org/#/c/539893/
• https://bugs.launchpad.net/nova/+bug/1739593
• https://access.redhat.com/security/cve/cve-2017-18191
• https://bugzilla.redhat.com/show_bug.cgi?id=1546937
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18191
• https://www.securityfocus.com/bid/103104/info

CIRT Team

Recommended Posts

Active Exploitation of Critical F5 BIG – IP Vulnerability (CVE–2023-46747) Uncovered in Bangladesh

06 Nov 2024 - Security Advisories & Alerts

Emerging Threat_Stealer Malware (Lumma C2) Campaign with fake CAPTCHA pages

08 Oct 2024 - Security Advisories & Alerts

Detection of Fog Ransomware Footprint in Cyber Space of Bangladesh

12 Sep 2024 - Security Advisories & Alerts