CVE-2014-3608: Low severity openstack compute (nova) vulnerability

Q: What is the severity of CVE-2014-3608?

CVE-2014-3608 is classified as a medium-severity vulnerability.

Q: How do I fix CVE-2014-3608?

To fix CVE-2014-3608, upgrade OpenStack Nova to version 2014.1.3 or later.

Q: Who is affected by CVE-2014-3608?

CVE-2014-3608 affects users running OpenStack Nova versions prior to 2014.1.3.

Q: What does CVE-2014-3608 exploit?

CVE-2014-3608 exploits a vulnerability in the VMWare driver allowing quota limit bypass.

Q: What is the impact of CVE-2014-3608?

The impact of CVE-2014-3608 can lead to denial of service due to resource consumption.

Published Oct 6, 2014

Updated

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

Affected Software

2 affected components

Openstack Nova>=2013.2<=2013.2.4

Openstack Nova>=2014.1<2014.1.3

Event History

Oct 6, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3608?

CVE-2014-3608 is classified as a medium-severity vulnerability.

How do I fix CVE-2014-3608?

To fix CVE-2014-3608, upgrade OpenStack Nova to version 2014.1.3 or later.

Who is affected by CVE-2014-3608?

CVE-2014-3608 affects users running OpenStack Nova versions prior to 2014.1.3.

What does CVE-2014-3608 exploit?

CVE-2014-3608 exploits a vulnerability in the VMWare driver allowing quota limit bypass.

What is the impact of CVE-2014-3608?