An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x…
Priority LOW 16Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.
Why it matters now
EPSS 0.00309 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial nova (PyPI): 23.2.2, 24.1.2, 25.0.2Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nova (PyPI) | before 23.2.2 | 23.2.2 | Patch available | GHSA-v725-c588-h936 |
| — | nova (PyPI) | 24.0.0 to before 24.1.2 | 24.1.2 | Patch available | GHSA-v725-c588-h936 |
| — | nova (PyPI) | 25.0.0 to before 25.0.2 | 25.0.2 | Patch available | GHSA-v725-c588-h936 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected before 23.2.2 Fixed in 23.2.2 Patch available GHSA-v725-c588-h936
- nova (PyPI) Vendor— Affected 24.0.0 to before 24.1.2 Fixed in 24.1.2 Patch available GHSA-v725-c588-h936
- nova (PyPI) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-v725-c588-h936
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* | before 23.2.2; 24.0.0 to before 24.1.2; 25.0.0 to before 25.0.2 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions before 23.2.2; 24.0.0 to before 24.1.2; 25.0.0 to before 25.0.2 Vulnerable ·OpenStack
Remediation
- Fix · GHSA-v725-c588-h936 nova (PyPI) Fixed in 23.2.2 Advisory →
- Fix · GHSA-v725-c588-h936 nova (PyPI) Fixed in 24.1.2 Advisory →
- Fix · GHSA-v725-c588-h936 nova (PyPI) Fixed in 25.0.2 Advisory →
Red Hat 1 advisory
- RHSA-2023:1948 Released 2023-04-26 · Red Hat rating LowRed Hat OpenStack Platform 16.2 (openstack-nova) security update
- Red Hat OpenStack Platform 16.2 openstack-nova-1:20.6.2-2.20230308185148.fc01371.el8ost
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1948 |
Not affected: 1 product
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-37394
- 2026-10-03 Alias added: GHSA-v725-c588-h936
References
Advisory 2
Other 7
- https://github.com/openstack/nova/commit/0c87681135cfb3ce61d2a0392928c1dbc1fe5fde
- https://github.com/openstack/nova/commit/1a98a1a650d065a8ab3e1c474f3b9fd537dc2206
- https://github.com/openstack/nova/commit/4954f993680c75fd9d3d507f2dcd00300c9b3d44
- https://github.com/openstack/nova/commit/a28c82719545d5c8ee7f3ff1361b3a796e05095a
- https://github.com/openstack/nova/commit/e43bf900dc8ca66578603bed333c56b215b1876e
- https://github.com/openstack/nova/commit/f8c91eb75fc5504a37fc3b4be1d65d33dbc9b511
- https://github.com/openstack/nova
More OpenStack Nova vulnerabilities
- TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
- TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
- TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
- TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
- TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
- TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
Sources
- CVE-2022-37394 · CVE Program
- CVE-2022-37394 · NVD
- FIRST EPSS
- GHSA-v725-c588-h936 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-37394 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences