CVE-2022-37394: Low severity openstack compute (nova) vulnerability
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-37394.
What is the severity level of CVE-2022-37394?
CVE-2022-37394 has a severity level of low.
What software versions are affected by CVE-2022-37394?
CVE-2022-37394 affects OpenStack Nova versions before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2.
How can an authenticated user exploit CVE-2022-37394?
An authenticated user can exploit CVE-2022-37394 by creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap.
Are there any references available for CVE-2022-37394?
Yes, you can find references for CVE-2022-37394 at the following links: [Link 1](https://bugs.launchpad.net/ossa/+bug/1981813), [Link 2](https://review.opendev.org/c/openstack/nova/+/849985), [Link 3](https://review.opendev.org/c/openstack/nova/+/850003).