Security restrictions bypass in Red Hat OpenStack Platform 16.1

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU76039

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2088

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an attacker to gain unauthorized access to a volume.

The vulnerability exists due to the way OpenStack handles situations with volume deletions. A regular user can create an instance with a volume, and then delete the volume attachment directly in Cinder, which neglects to notify Nova.

The compute node SCSI plumbing (over iSCSI/FC) will continue trying to connect to the original host/port/LUN, not knowing the attachment has been deleted. If a subsequent volume attachment re-uses the host/port/LUN for a different instance and volume, the original instance will gain access to it once the SCSI plumbing reconnects.

Only deployments with iSCSI or FC volumes are affected.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 16.1

Red Hat OpenStack: 16.1

python-os-brick (Red Hat package): before 2.10.5-1.20220112193420.634fb4a.el8ost

python-glance-store (Red Hat package): before 1.0.2-1.20220219073735.el8ost

openstack-nova (Red Hat package): before 20.4.1-1.20221005193232.el8ost

openstack-cinder (Red Hat package): before 15.4.0-1.20230510003501.58f0e73.el8ost

External links

http://access.redhat.com/errata/RHSA-2023:3156

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.