Permissions, Privileges, and Access Controls in Openstack products - CVE-2023-2088

Vulnerability identifier: #VU76039

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-2088

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain unauthorized access to a volume.

The vulnerability exists due to the way OpenStack handles situations with volume deletions. A regular user can create an instance with a volume, and then delete the volume attachment directly in Cinder, which neglects to notify Nova.

The compute node SCSI plumbing (over iSCSI/FC) will continue trying to connect to the original host/port/LUN, not knowing the attachment has been deleted. If a subsequent volume attachment re-uses the host/port/LUN for a different instance and volume, the original instance will gain access to it once the SCSI plumbing reconnects.

Only deployments with iSCSI or FC volumes are affected.

Os-brick
Glance_store
Openstack Nova
Cinder
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Ubuntu
tripleo-ansible (Red Hat package)
python-glance-store (Red Hat package)
python3-glance-store (Ubuntu package)
python-os-brick (Red Hat package)
python3-os-brick (Ubuntu package)
openstack-cinder (Red Hat package)
python3-cinder (Ubuntu package)
openstack-nova (Red Hat package)
python3-ironic (Ubuntu package)
python3-nova (Ubuntu package)

Install updates from vendor's website.

Os-brick - addressed in versions 5.2.3, 6.1.1, 6.2.2
tripleo-ansible (Red Hat package) - addressed in versions 0.8.1-2.20230309004941.el8ost, 3.3.1-0.20221208161844.fa5422f.el9ost
python-glance-store (Red Hat package) - addressed in versions 0.23.1-0.20190916165255.cc7ecc1.el7ost, 1.0.2-1.20220219073735.el8ost, 1.0.2-2.20230309124927.79e043a.el8ost, 2.5.1-0.20230509140449.5f1cee6.el9ost
python3-glance-store (Ubuntu package) - addressed in versions 2.0.0-0ubuntu4.1, 3.0.0-0ubuntu1.1, 3.0.0-0ubuntu1.3, 4.1.0-0ubuntu1.1, 4.3.0-0ubuntu1.1, 4.3.0-0ubuntu1.3
python-os-brick (Red Hat package) - addressed in versions 2.3.9-12.el7ost, 2.10.5-1.20220112193420.634fb4a.el8ost, 2.10.8-2.20220112064936.458bfad.el8ost, 4.3.3-0.20220715140803.d09dc9e.el9ost
python3-os-brick (Ubuntu package) - addressed in versions 3.0.8-0ubuntu1.1, 5.2.2-0ubuntu1.2, 5.2.2-0ubuntu1, 6.1.0-0ubuntu1.1, 6.2.0-0ubuntu2.1, 6.2.0-0ubuntu2.3
openstack-cinder (Red Hat package) - addressed in versions 15.4.0-1.20230510003501.58f0e73.el8ost, 15.6.1-2.20230310075425.a19c1c9.el8ost, 18.2.1-0.20230509200451.1776695.el9ost
python3-cinder (Ubuntu package) - addressed in versions 2:16.4.2-0ubuntu2.3, 2:20.1.0-0ubuntu2.1, 2:20.2.0-0ubuntu1.1, 2:21.1.0-0ubuntu2.1, 2:22.0.0-0ubuntu1.1, 2:22.0.0-0ubuntu1.3
openstack-nova (Red Hat package) - addressed in versions 17.0.13-41.el7ost, 20.4.1-1.20221005193232.el8ost, 20.6.2-2.20230308185149.el8ost, 23.2.2-0.20221209190754.7074ac0.el9ost
python3-ironic (Ubuntu package) - addressed in versions 1:20.1.0-0ubuntu1.1, 1:21.4.0-0ubuntu1.1
python3-nova (Ubuntu package) - addressed in versions 2:21.2.4-0ubuntu2.3, 3:25.1.0-0ubuntu2.1, 3:25.1.1-0ubuntu1.1, 3:26.1.0-0ubuntu2.1, 3:27.0.0-0ubuntu1.1, 3:27.0.0-0ubuntu1.3

• https://security.openstack.org/ossa/OSSA-2023-003.html

• Unauthorized volume access in OpenStack
• Ubuntu update for python-os-brick
• Ubuntu update for nova
• Ubuntu update for python-glance-store
• Ubuntu update for cinder
• Security restrictions bypass in Red Hat OpenStack Platform 13
• Security restrictions bypass in Red Hat OpenStack Platform 16.2
• Security restrictions bypass in Red Hat OpenStack Platform 17.0
• Security restrictions bypass in Red Hat OpenStack Platform 16.1
• Ubuntu update for cinder