CVE-2017-18191

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-02-19 · updated 2026-06-17

Description

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.

Affected products

OpenStack Nova: from 15.0.0 through 15.1.0; from 16.0.0 through 16.1.1
OpenStack: 9, 10, 12

References

http://openwall.com/lists/oss-security/2018/04/20/3
http://www.securityfocus.com/bid/103104
https://access.redhat.com/errata/RHSA-2018:2332
https://access.redhat.com/errata/RHSA-2018:2714
https://access.redhat.com/errata/RHSA-2018:2855
https://launchpad.net/bugs/1739593
https://review.openstack.org/539893
https://security.openstack.org/ossa/OSSA-2018-001.html
http://openwall.com/lists/oss-security/2018/04/20/3
http://www.securityfocus.com/bid/103104
https://access.redhat.com/errata/RHSA-2018:2332
https://access.redhat.com/errata/RHSA-2018:2714

Get alerted when CVE-2017-18191 or the next vulnerability affects your stack