CVE-2014-3608

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

This update for openstack-nova provides stability fixes from the upstream OpenStack project:

* Add @retry_on_deadlock to _instance_update()
* Fix nova-compute start issue after evacuate
* Fix nova evacuate issues for RBD
* Add _wrap_db_error() support to SessionTransaction.commit()
* Fixes DoS issue in instance list ip filter (bnc#903013,
  CVE-2014-3708)
* Make the block device mapping retries configurable
* Retry on closing of luks encrypted volume in case device is busy
* Nova api service doesn't handle SIGHUP properly
* Fix XML UnicodeEncode serialization error
* share neutron admin auth tokens
* Fix CellStateManagerFile init to failure
* postgresql: use postgres db instead of template1
* Fix instance cross AZ check when attaching volumes
* Fixes missing ec2 api address disassociate error on failure
* Ignore errors when deleting non-existing vifs
* VMware: validate that VM exists on backend prior to deletion
* VMWare: Fix VM leak when deletion of VM during resizing
* Sync process utils from oslo
* VMware: prevent race condition with VNC port allocation (bnc#901087,
  CVE-2014-8750)
* Fixes Hyper-V volume mapping issue on reboot
* Raise descriptive error for over volume quota
* libvirt: Handle unsupported host capabilities
* libvirt: Make fakelibvirt.libvirtError match
* Adds tests for Hyper-V VM Utils
* Removes unnecessary instructions in test_hypervapi
* Fixes a Hyper-V list_instances localization issue
* Adds list_instance_uuids to the Hyper-V driver
* Add _wrap_db_error() support to Session.commit()
* Sync process and str utils from oslo (bnc#899190 CVE-2014-7230
  CVE-2014-7231)
* Fixes Hyper-V agent force_hyperv_utils_v1 flag issue
* Fix live-migration failure in FC multipath case
* libvirt: Save device_path in connection_info when booting from volume
* Fixes Hyper-V boot from volume root device issue
* Catch missing Glance image attrs with None
* Adds get_instance_disk_info to compute drivers
* Include next link when default limit is reached
* VM in rescue state must have a restricted set of actions to avoid
  leaking rescued images (bnc#899199, CVE-2014-3608)
* libvirt: return the correct instance path while cleanup_resize
* Fix nova image-show with queued image
* _translate_from_glance() can cause an unnecessary HTTP request
* Neutron: Atomic update of instance info cache
* Ensure info cache updates don't overwhelm cells
* remove test_multiprocess_api
* Fixes Hyper-V resize down exception
* libvirt: Use VIR_DOMAIN_AFFECT_LIVE for paused instances
* Fix _parse_datetime in simple tenant usage extension
* Avoid traceback logs from simple tenant usage extension
* Made unassigned networks visible in flat networking
* VMware: validate that VM exists on backend prior to deletion
  (bnc#898371)
* Fix attaching config drive issue on Hyper-V when migrate instances
* Do not fail cell's instance deletion, if it's missing info_cache
* Fixes Hyper-V vm state issue
* Update block_device_info to contain swap and ephemeral disks
* Loosen import_exceptions to cover all of gettextutils
* Fix instance boot when Ceph is used for ephemeral storage
* VMware: do not cache image when root_gb is 0
* Delete image when backup operation failed on snapshot step
* db: Add @_retry_on_deadlock to service_update()
* Fix rootwrap for non openstack.org iqn's
* Add Hyper-V driver in the 'compute_driver' option description
* Block sqlalchemy migrate 0.9.2 as it breaks all of nova
* Move the error check for 'brctl addif'
* Add a retry_on_deadlock to reservations_expire
* Add expire reservations in backport position
* Make floatingip-ip-delete atomic with neutron
* add repr for event objects
* make lifecycle event logs more clear
* Fix race condition with vif…

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

Garth Mollett discovered that OpenStack Nova did not properly clean up an instance when using rescue mode with the VMWare driver. A remove authenticated user could exploit this to bypass intended quota limits. By default, Ubuntu does not use the VMWare driver. (CVE-2014-3608)

Amrith Kumar discovered that OpenStack Nova did not properly sanitize log message contents. Under certain circumstances, a local attacker with read access to Nova log files could obtain access to sensitive information. (CVE-2014-7230)