CVE-2015-3241: Medium severity openstack compute (nova) vulnerability
OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.
Other sources
Title: Nova instance migration process does not stop when instance is deleted Reporter: George Shuklin (Webzilla LTD) Products: Nova Affects: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0
Description: George Shuklin from Webzilla LTD reported a vulnerability in Nova migration process. By resizing and deleting an instance repeatedly an authenticated user may overcome his quota and overload Nova computes node resulting in a denial of service attack. All Nova setups are affected.
Upstream bug: https://launchpad.net/bugs/1387543
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3241?
CVE-2015-3241 has been classified as a moderate severity vulnerability that can lead to denial of service.
How do I fix CVE-2015-3241?
To fix CVE-2015-3241, upgrade to OpenStack Nova version 12.0.0.0b3 or later.
Which versions of OpenStack Nova are affected by CVE-2015-3241?
CVE-2015-3241 affects OpenStack Compute (Nova) versions 2014.2.3 and earlier, as well as versions 2015.1.0 to 2015.1.1.
What types of issues does CVE-2015-3241 create?
CVE-2015-3241 allows remote authenticated users to cause resource consumption, leading to potential denial of service.
Is user authentication required to exploit CVE-2015-3241?
Yes, an authenticated remote user can exploit CVE-2015-3241 by manipulating instance migration and deletion.