REDHAT-BUG-1232782
First published: Wed Jun 17 2015(Updated: )
Title: Nova instance migration process does not stop when instance is deleted Reporter: George Shuklin (Webzilla LTD) Products: Nova Affects: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description: George Shuklin from Webzilla LTD reported a vulnerability in Nova migration process. By resizing and deleting an instance repeatedly an authenticated user may overcome his quota and overload Nova computes node resulting in a denial of service attack. All Nova setups are affected. Upstream bug: <a href="https://launchpad.net/bugs/1387543">https://launchpad.net/bugs/1387543</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Nova-LXD | <=2014.1.4>=2014.2<=2014.2.3=2015.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://launchpad.net/bugs/1387543
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1241367
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1241370
- https://security.openstack.org/ossa/OSSA-2015-015.html
- https://access.redhat.com/errata/RHSA-2015:1723
- https://rhn.redhat.com/errata/RHSA-2015-1898.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1232782
Frequently Asked Questions
What is the severity of REDHAT-BUG-1232782?
The severity of REDHAT-BUG-1232782 is considered high due to the potential for incomplete instance migration during deletion.
How do I fix REDHAT-BUG-1232782?
To fix REDHAT-BUG-1232782, upgrade to a version of OpenStack Nova that is not affected, specifically to versions after 2014.2.3 or 2015.1.1 and above.
Which versions are affected by REDHAT-BUG-1232782?
REDHAT-BUG-1232782 affects OpenStack Nova versions up to 2014.1.4, 2014.2.x through 2014.2.3, and precisely 2015.1.0.
What is the impact of REDHAT-BUG-1232782 on system performance?
The impact of REDHAT-BUG-1232782 on system performance includes possible resource leaks as instance migration may continue even after an instance is deleted.
Who reported the REDHAT-BUG-1232782 vulnerability?
The REDHAT-BUG-1232782 vulnerability was reported by George Shuklin from Webzilla LTD.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-3241
- agent/references
- agent/severity
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/openstack nova-lxd