CVE-2014-3608

Publication date 6 October 2014

Last updated 4 August 2025

Ubuntu priority

Description

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nova	14.10 utopic	Not affected
	14.04 LTS trusty	Fixed 1:2014.1.3-0ubuntu1.1
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

jdstrand

requires use with unsupported VMware ESX driver. This is not compiled in to libvirt in the Ubuntu archive, which makes this code path unavailable in Ubuntu

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nova	Upstream: https://review.openstack.org/#/c/94281/ Upstream: https://review.openstack.org/#/c/109624/

References

Related Ubuntu Security Notices (USN)

USN-2407-1
OpenStack Nova vulnerabilities
11 November 2014