RHSA-2018:0241 - Security Advisory

Topic

An update for openstack-nova is now available for Red Hat OpenStack Platform 12.0 (Pike).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances and controlling access through users and projects.

Security Fix(es):

• By rebuilding an instance using a new image, an authenticated user may be able to circumvent the Filter Scheduler, bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). (CVE-2017-16239)

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges George Shuklin (Servers.com) as the original reporter.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack for IBM Power 12 ppc64le
• Red Hat OpenStack 12 x86_64

Fixes

• BZ - 1508539 - CVE-2017-16239 openstack-nova: Nova Filter Scheduler bypass through rebuild action
• BZ - 1518879 - Cannot boot vm with sriov port after upgrade OSP11 to OSP12
• BZ - 1527644 - Unable to resize nova instance after upgrade to OSP 10
• BZ - 1533161 - migration with block migration fails as disk_available_least is negative

CVEs

• CVE-2017-16239

References

• https://access.redhat.com/security/updates/classification/#moderate