CVE-2014-3608

What it actually does

The VMware driver in Nova permits authenticated users to bypass quota enforcement by transitioning a VM through rescue state, suspension (resulting in ERROR state), and image deletion, consuming resources without quota accounting.

Why it matters to the business

Attackers can exhaust shared compute resources, causing service outages and unplanned capacity consumption across virtualized environments.

How an attack unfolds

An authenticated user creates a VM, places it into rescue mode, suspends the instance to force an ERROR state, then deletes the backing image, evading quota checks and accumulating unaccounted resource usage.

How to fix it

Upgrade OpenStack Nova to version 2014.1.3 or later to enforce proper quota checks during rescue, suspend, and delete operations.

How to confirm the fix worked

Verify Nova version is at least 2014.1.3, then attempt the rescue-suspend-delete sequence under quota limits and confirm the operation is rejected.

Typical attack path

1. Authenticate to OpenStack Nova with a valid user account
2. Launch a VM instance
3. Transition the VM to rescue state
4. Suspend the VM to trigger ERROR state
5. Delete the associated image to bypass quota limits
6. Repeat to consume additional resources

How to detect it

Search Nova compute logs and API audit records for sequences of rescue, suspend, and image-delete events originating from the same user or tenant within short time windows.

• nova-compute.log entries containing "rescue" followed by "suspend" and "delete"
• API audit logs showing state transitions to ERROR without corresponding quota decrement

What your security team should do

• Immediately upgrade all Nova deployments to 2014.1.3 or newer
• Audit existing VMs for unexpected ERROR states or orphaned images
• Enable detailed Nova API and state-change logging for quota-related events
• Review and tighten rescue and suspend permissions for non-admin users