CVE-2016-7498 Denial of service in n/a
Remote authenticated users can cause disk consumption denial of service by deleting instances during resize operations in OpenStack Compute.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7498?
CVE-2016-7498 is a medium-severity denial of service vulnerability in n/a, published on 27 Sep 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state. NOTE: this vulnerability exists because of a CVE-2015-3280 regression.
Weakness: CWE-399
Which versions are affected by CVE-2016-7498?
It affects 1 product.
Products include Openstack Compute \(Nova\).
How do I fix CVE-2016-7498?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-7498 being exploited?
There is no known exploitation of CVE-2016-7498 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-7498, GHSA-47vm-xhwp-2v86.