Security restrictions bypass in Red Hat OpenStack Platform 13
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-2088 |
| CWE-ID | CWE-264 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Red Hat OpenStack Server applications / Other server solutions python-os-brick (Red Hat package) Operating systems & Components / Operating system package or component python-glance-store (Red Hat package) Operating systems & Components / Operating system package or component openstack-nova (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU76039
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-2088
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an attacker to gain unauthorized access to a volume.
The vulnerability exists due to the way OpenStack handles situations with volume deletions. A regular user can create an instance with a volume, and then delete the volume attachment directly in Cinder, which neglects to notify Nova.
The compute node SCSI plumbing (over iSCSI/FC) will continue trying to connect to the original host/port/LUN, not knowing the attachment has been deleted. If a subsequent volume attachment re-uses the host/port/LUN for a different instance and volume, the original instance will gain access to it once the SCSI plumbing reconnects.
Only deployments with iSCSI or FC volumes are affected.
MitigationInstall updates from vendor's website.
Red Hat OpenStack: 13.0
python-os-brick (Red Hat package): before 2.3.9-12.el7ost
python-glance-store (Red Hat package): before 0.23.1-0.20190916165255.cc7ecc1.el7ost
openstack-nova (Red Hat package): before 17.0.13-41.el7ost
CPE2.3- cpe:2.3:a:red_hat:red_hat_openstack:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:python-os-brick_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:python-glance-store_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:openstack-nova_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2023:3161
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
