CVE-2017-17051

Aliases:GHSA-vq76-rxx3-4r4r
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 05 Dec 2017, 18:00
Last modified:05 Aug 2024, 20:43

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.6 HIGH
v3.0 (nvd)
EPSS Score
0.84% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Dec 2017, 18:00
Published
Vulnerability first disclosed
05 Aug 2024, 20:43
Last Modified
Vulnerability information updated

Description

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.

CVSS Metrics

  • v3.0•HIGH•Score: 8.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.84%• Percentile: 75%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • openstack•nova

    16.0.3

  • PyPI•nova

    < 16.0.4

References (9)