Vulnerability GHSA-mfg3-p6m3-gjgr

Medium Risk

4 months ago

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

18.0.2 - 18.3.0 and 19.0.0.0rc1 and 19.0.0.0rc2 and 19.0.0 - 19.3.2 and 20.0.0.0rc1 and 20.0.0.0rc2 and 20.0.0 - 20.6.1 and 21.0.0.0rc1 and 21.0.0.0rc2 and 21.0.0 - 21.2.4 and 22.0.0.0rc1 and 22.0.0 - 22.4.0 and 23.0.0.0rc1 and 23.0.0.0rc2 and 23.0.0 - 23.2.2 and 24.0.0.0rc1 and 24.0.0.0rc2 and 24.0.0 - 24.2.1 and 25.0.0.0rc1 and 25.0.0 - 25.3.0 and 26.0.0.0rc1 and 26.0.0.0rc2 and 26.0.0 - 26.3.0 and 27.0.0.0rc1 and 27.0.0 - 27.5.1 and 28.0.0.0rc1 and 28.0.0 - 28.3.1 and 29.0.0.0rc1 and 29.0.0 - 29.4.0 and 30.0.0.0rc1 and 30.0.0 - 30.3.0 and 31.0.0.0rc1 and 31.0.0 - 33.0.1

Summary

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

Details

Affects

Nova: >=18.0.0 <31.3.1, >=32.0.0 <32.2.1, >=33.0.0 <33.0.2

Description

Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.