CVE-2022-37394

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-03 · updated 2026-06-17

Description

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.

Affected products

OpenStack Nova: before 23.2.2; from 24.0.0 before 24.1.2; from 25.0.0 before 25.0.2 — fixed in 23.2.2, 24.1.2, 25.0.2

How to fix

Upgrade to a fixed version: OpenStack Nova 23.2.2, 24.1.2, 25.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-37394 or the next vulnerability affects your stack