[Secure-testing-team] Bug#883621: nova: CVE-2017-17051: Nova FilterScheduler doubles resource allocations during rebuild with new image

[Salvatore Bonaccorso]

Source: nova
Version: 2:16.0.3-1
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for nova.

CVE-2017-17051[0]:
| An issue was discovered in the default FilterScheduler in OpenStack
| Nova 16.0.3. By repeatedly rebuilding an instance with new images, an
| authenticated user may consume untracked resources on a hypervisor host
| leading to a denial of service, aka doubled resource allocations. This
| regression was introduced with the fix for OSSA-2017-005
| (CVE-2017-16239); however, only Nova stable/pike or later deployments
| with that fix applied and relying on the default FilterScheduler are
| affected.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17051
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17051
[1] http://www.openwall.com/lists/oss-security/2017/12/05/5

Regards,
Salvatore