CVE-2014-8750 Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that...
MediumCVSS 6.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack Nova | >= 2014.1, < 2014.1.4 | 2014.1.4 |
| OpenStack Nova | = 2014.2-milestone1 | No fix listed |
| OpenStack Nova | = 2014.2-milestone2 | No fix listed |
| OpenStack Nova | = 2014.2-milestone3 | No fix listed |
References
- [openstack-announce] 20141014 [OSSA 2014-035] Nova VMware driver may connect VNC to another tenant's console (CVE-2014-8750) mailing-list vendor-advisory
- RHSA-2014:1689 third-party-advisory vendor-advisory
- RHSA-2014:1781 third-party-advisory vendor-advisory
- RHSA-2014:1782 third-party-advisory vendor-advisory
- 60227 third-party-advisory
- [oss-security] 20141014 [OSSA 2014-035] Nova VMware driver may connect VNC to another tenant's console (CVE-2014-8750) mailing-list third-party-advisory
- 70182 third-party-advisory vdb-entry
- bugs.launchpad.net third-party-advisory
- Debian Security Tracker CVE-2014-8750 vendor-advisory