OSSA-2018-001: Raw underlying encrypted volume access

OSSA-2018-001: Raw underlying encrypted volume access

Date:April 20, 2018


  • Nova: >=15.0.0 <=15.1.0, >=16.0.0 <=16.1.1


Lee Yarwood (Red Hat) reported a vulnerability in Nova encrypted volumes handling. By detaching and reattaching an encrypted volume an attacker may access the underlying raw volume and corrupt the LUKS header resuling in a denial of service attack on the compute host. All Nova setups supporting encrypted volumes are affected.


  • Lee Yarwood from Red Hat (CVE-2017-18191)


  • Pike and Ocata patches disable encrypted volume swapping, this feature is now only supported in Nova version >= 17.0.0.
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.