#VU76039 Permissions, Privileges, and Access Controls in Openstack Client/Desktop applications
Vulnerability identifier: #VU76039
Vulnerability risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Cinder
Server applications /
Other server solutions
Glance_store
Universal components / Libraries /
Libraries used by multiple products
Os-brick
Universal components / Libraries /
Libraries used by multiple products
Openstack Nova
Client/Desktop applications /
Other client software
Vendor: Openstack
Description
The vulnerability allows an attacker to gain unauthorized access to a volume.
The vulnerability exists due to the way OpenStack handles situations with volume deletions. A regular user can create an instance with a volume, and then delete the volume attachment directly in Cinder, which neglects to notify Nova.
The compute node SCSI plumbing (over iSCSI/FC) will continue trying to connect to the original host/port/LUN, not knowing the attachment has been deleted. If a subsequent volume attachment re-uses the host/port/LUN for a different instance and volume, the original instance will gain access to it once the SCSI plumbing reconnects.
Only deployments with iSCSI or FC volumes are affected.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Cinder: 21.1.0, 21.0.0, 20.1.0, 20.0.0 - 20.0.1, 10.1.2 - 10.1.7, 19.2.0, 19.1.0 - 19.1.1, 19.0.0, 18.2.0 - 18.2.1, 18.1.0, 18.0.0, 17.4.0, 17.3.0, 17.2.0, 17.1.0, 17.0.0 - 17.0.1, 16.4.0 - 16.4.2, 16.3.0, 16.2.0 - 16.2.1, 16.1.0, 16.0.0, 15.6.0, 15.5.0, 15.4.0 - 15.4.1, 15.3.0, 15.2.0, 15.1.0, 15.0.0 - 15.0.1, 14.3.0 - 14.3.1, 14.2.0 - 14.2.1, 14.1.0, 14.0.0 - 14.0.4, 13.0.0 - 13.0.9, 12.0.0 - 12.0.10, 11.2.0 - 11.2.2, 11.1.0 - 11.1.1, 11.0.0 - 11.0.2, 10.0.0 - 10.0.8
Glance_store: 0.1.0 - 4.3.0
Openstack Nova: 0.9.0 - 2015.1.4
Os-brick: 0.1.0 - 6.2.1
External links
http://security.openstack.org/ossa/OSSA-2023-003.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
