Executive brief
OpenStack Compute (Nova) is the cloud computing service that manages virtual machine instances in an OpenStack cloud infrastructure. This vulnerability allows remote attackers to bypass security group restrictions when resizing instances or performing live migration on the XenAPI hypervisor backend, potentially exposing instances to unauthorized network traffic and access.
Technical details
The XenAPI backend in OpenStack Nova fails to properly reapply security group firewall rules during image resize operations and live migration. The root cause is that security group rules are not reapplied when instances are migrated to a new hypervisor or resized. An unauthenticated or authenticated remote attacker can exploit this by migrating or resizing an instance to bypass intended network access controls. The vulnerability affects Folsom, Grizzly, and Havana releases prior to 2013.2. Patches were applied to reapply firewall rules during finish_migrate and resize operations.
Affected products
- OpenStack Compute Nova Folsom, Grizzly, and Havana before 2013.2
Timeline
- 2013-11-05: disclosed
- 2013.2: patched