|
| 1 | +--- |
| 2 | +title: Lacking sanitization of Nova scheduler hints (OSSA-2026-022 / CVE-2026-46448) |
| 3 | +authors: [garloff] |
| 4 | +slug: nova_lacking_scheulder_hints_sanitization_ossa_2026_022 |
| 5 | +tags: [security, openstack, nova, cve] |
| 6 | +--- |
| 7 | + |
| 8 | +## The vulnerability |
| 9 | + |
| 10 | +When talking to the OpenStack Nova Compute API, Users can specify scheduler |
| 11 | +hints, expressing preferences for Server (VM) placement. Users can however |
| 12 | +inject a values `{"_nova_check_type": "rebuild"}` that is only meant to be used |
| 13 | +internally in the rebuild context which causes certain resource checks to be |
| 14 | +skipped. This can cause placement contraints such as host aggregates, AZs, image |
| 15 | +traits to be ignored and cause PCI pass-through resources to not be properly |
| 16 | +mapped. While the assigned quota is still observed, the vulnerability may cause |
| 17 | +exhaustion of resources and confusion of the scheduler (placement) state and |
| 18 | +thus may result in a Denial of Service for certain resource types. |
| 19 | + |
| 20 | +This issue was reported by Erichen, Institute of Computing Technology, Chinese |
| 21 | +Academy of Sciences and was subsequently analyzed and handled by Goutham Pacha Ravi, |
| 22 | +Dan Smith and Sylvain Bauza. It was assigned CVE-2026-46448. |
| 23 | + |
| 24 | +## Impact on the SCS software ecosystem |
| 25 | + |
| 26 | +Malevolent authenticated users could use this to schedule VMs on hosts that |
| 27 | +would normally not be accessible to their VMs (e.g. because they are in a |
| 28 | +host aggregate only available to GPU flavors which are manually enabled for |
| 29 | +selected customers only). This could result in resource exhaustion for |
| 30 | +legitimate users and cause the placement accounting to be confused. |
| 31 | + |
| 32 | +This will mainly affect providers that exposed specialized features via |
| 33 | +special flavors (such as e.g. GPUs) which may be scarce. In particular, |
| 34 | +PCI devices may be assigned without proper accounting in the placement |
| 35 | +service. |
| 36 | + |
| 37 | +## Embargo |
| 38 | + |
| 39 | +The issue was reported to the OpenStack Vulnerability Management Team. |
| 40 | +Following coordination with the reporters and upstream developers, the official |
| 41 | +OpenStack Security Advisory |
| 42 | +[OSSA-2026-022](https://security.openstack.org/ossa/OSSA-2026-022.html) was |
| 43 | +published on Tuesday, 2026-06-16, 15:00 UTC. |
| 44 | + |
| 45 | +## Mitigation and Fixes |
| 46 | + |
| 47 | +The fix consists in ensuring that internal `_nova_` scheduler hints are properly |
| 48 | +filtered out in the API exposed to users. |
| 49 | + |
| 50 | +Providers are advised to deploy fixed nova-api containers. |
| 51 | +The SCS ecosystem software providers will provide fixed nova images along with |
| 52 | +update instructions. |
| 53 | + |
| 54 | +- [OSISM](https://osism.tech/docs/appendix/security/ossa-2026-022) |
| 55 | +- [yaook](https://yaook.cloud/security-advisories-cve-2026-46448/) |
| 56 | + |
| 57 | +Operators where users may have caused confusion in the placement accounting |
| 58 | +will need to run |
| 59 | + |
| 60 | +```shell |
| 61 | +nova-manage placement heal_allocations |
| 62 | +``` |
| 63 | + |
| 64 | +to ensure that accounting in the placement service is consistent again. |
| 65 | + |
| 66 | +## References |
| 67 | + |
| 68 | +- [OSSA-2026-022 Advisory](https://security.openstack.org/ossa/OSSA-2026-022.html) |
| 69 | +- [Launchpad Bug #2151252](https://bugs.launchpad.net/nova/+bug/2151252) |
| 70 | + |
| 71 | +## Thanks |
| 72 | + |
| 73 | +The author would like to thank the reporters, the OpenStack vulnerability |
| 74 | +management team and the abovementioned maintainers for reporting, |
| 75 | +analyzing, fixing and handling the issue. |
| 76 | + |
| 77 | +## Sovereign Cloud Stack Security Contact |
| 78 | + |
| 79 | +SCS security contact is |
| 80 | +[security@scs.community](mailto:security@scs.community), as published on |
| 81 | +[https://sovereigncloudstack.org/.well-known/security.txt](https://sovereigncloudstack.org/.well-known/security.txt). |
| 82 | + |
| 83 | +## Version history |
| 84 | + |
| 85 | +- Initial draft, v0.5, 2026-06-16, 13:30 CEST |
| 86 | +- Initial publication, v1.0, 2026-06-16, 17:00 CEST |
| 87 | +- Link OSISM advisory, v1.1, 2026-06-16, 19:30 CEST |
| 88 | +- Link yaook advisory, v1.2, 2026-06-17, 13:30 CEST |
0 commit comments