Vulnerability Name:

CVE-2017-17051 (CCN-135984)

Assigned:2017-12-05
Published:2017-12-05
Updated:2019-10-03
Summary:An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.
CVSS v3 Severity:8.6 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
7.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-400
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2017-17051

Source: BID
Type: Third Party Advisory, VDB Entry
102102

Source: CCN
Type: BID-102102
OpenStack Nova CVE-2017-17051 Incomplete Fix Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
openstack-cve201717051-dos(135984)

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://launchpad.net/bugs/1732976

Source: CONFIRM
Type: Vendor Advisory
https://review.openstack.org/521662

Source: CONFIRM
Type: Vendor Advisory
https://review.openstack.org/523214

Source: CCN
Type: OSSA-2017-006
Nova FilterScheduler doubles resource allocations during rebuild with new image

Source: CONFIRM
Type: Vendor Advisory
https://security.openstack.org/ossa/OSSA-2017-006.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openstack:nova:16.0.3:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openstack:nova:16.0.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201717051
    V
    		CVE-2017-17051
    2022-05-22
    oval:org.opensuse.security:def:60502
    P
    		Security update for python36-pip (Moderate)
    2022-01-12
    oval:org.opensuse.security:def:60423
    P
    		Security update for openexr (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:59571
    P
    		Security update for clamav (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:59816
    P
    		Security update for tomcat (Important)
    2021-11-03
    oval:org.opensuse.security:def:60382
    P
    		Security update for squid (Moderate)
    2021-10-11
    oval:org.opensuse.security:def:63238
    P
    		skopeo-0.1.32-4.5.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61678
    P
    		xen-libs-4.12.0_12-1.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63243
    P
    		sysstat-isag-12.0.2-3.6.12 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61593
    P
    		libxcb-composite0-1.13-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61594
    P
    		libxerces-c-3_1-3.1.4-3.3.25 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61617
    P
    		pam_ssh-2.1-2.27 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:61677
    P
    		xdg-utils-20170508-3.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63327
    P
    		freeradius-server-3.0.21-3.6.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63377
    P
    		squid-4.13-5.23.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63339
    P
    		libfpm_pb0-1.1.1-2.29 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63431
    P
    		libgstreamer-1_0-0-32bit-1.16.2-1.53 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63378
    P
    		stunnel-5.57-3.11.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63515
    P
    		python2-ovs-2.11.5-3.15.3 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63481
    P
    		libSDL2-2_0-0-32bit-2.0.8-9.63 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62059
    P
    		dbus-1-1.12.2-8.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62253
    P
    		libzip-devel-1.5.1-1.9 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62383
    P
    		containerd-1.3.9-5.29.3 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62146
    P
    		libcryptopp-devel-5.6.5-1.3.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62342
    P
    		umoci-0.4.6-3.9.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63042
    P
    		python39-tools-3.9.4-2.9 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63009
    P
    		go1.14-1.14.15-1.35.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:60286
    P
    		Security update for libjpeg-turbo (Moderate)
    2021-06-11
    oval:org.opensuse.security:def:59871
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:60464
    P
    		Security update for open-iscsi (Important)
    2021-03-01
    oval:org.opensuse.security:def:61786
    P
    		libX11-6-1.6.5-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63140
    P
    		apache2-mod_apparmor-2.12-5.9 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63276
    P
    		libmariadb-devel-3.1.8-3.18.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61701
    P
    		autoyast2-4.2.37-1.6 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63410
    P
    		nodejs8-8.17.0-8.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:61872
    P
    		libpython3_6m1_0-3.6.10-3.53.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62593
    P
    		perl-CGI-4.38-1.17 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62912
    P
    		openldap2-devel-32bit-2.4.46-9.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62474
    P
    		libthai-devel-0.1.27-1.16 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62688
    P
    		libopenjpeg1-1.5.2-2.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63144
    P
    		bind-9.11.2-10.4 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:58959
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60170
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:59934
    P
    		Security update for qemu (Important)
    2020-12-01
    oval:org.opensuse.security:def:58960
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60123
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:58982
    P
    		Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:59199
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:59138
    P
    		Security update for mailman (Important)
    2020-12-01
    oval:org.opensuse.security:def:59200
    P
    		Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60541
    P
    		socat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59390
    P
    		Security update for libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59222
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60638
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60619
    P
    		Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60591
    P
    		Security update for python-cryptography (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59380
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60722
    P
    		Security update for mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:59686
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:60801
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:59633
    P
    		Security update for virglrenderer (Important)
    2020-12-01
    oval:org.opensuse.security:def:60760
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:60880
    P
    		Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60851
    P
    		Security update for nodejs6 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:87983
    P
    		Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)
    2019-09-18
    oval:org.opensuse.security:def:88286
    P
    		Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)
    2019-09-18
    oval:org.opensuse.security:def:84333
    P
    		Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)
    2019-08-26
    oval:org.opensuse.security:def:83885
    P
    		Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)
    2019-08-26
    oval:com.ubuntu.artful:def:201717051000
    V
    		CVE-2017-17051 on Ubuntu 17.10 (artful) - medium.
    2017-12-05
    oval:com.ubuntu.bionic:def:2017170510000000
    V
    		CVE-2017-17051 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-12-05
    oval:com.ubuntu.bionic:def:201717051000
    V
    		CVE-2017-17051 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-12-05
    oval:com.ubuntu.xenial:def:2017170510000000
    V
    		CVE-2017-17051 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-12-05
    oval:com.ubuntu.trusty:def:201717051000
    V
    		CVE-2017-17051 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-12-05
    oval:com.ubuntu.xenial:def:201717051000
    V
    		CVE-2017-17051 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-12-05
    BACK
    openstack nova 16.0.3
    openstack nova 16.0.3