CVE-2023-2088

What it actually does

Inconsistency between Cinder and Nova volume handling permits a remote authenticated user to detach volumes in a manner that exposes attached data, resulting in unauthorized confidentiality disclosure without requiring additional privileges or user interaction.

Why it matters to the business

Organizations running affected OpenStack deployments face elevated risk of data exposure from storage volumes, potentially leading to compliance violations, loss of customer trust, and operational disruption while the inconsistency remains unaddressed.

How an attack unfolds

An attacker with valid credentials issues a volume detach operation through Cinder that exploits the state inconsistency with Nova, allowing the volume to be accessed or observed outside its intended attachment context and thereby disclosing confidential data.

How to fix it

Apply vendor-supplied updates that reconcile volume state between Cinder and Nova; until patches are available, enforce strict RBAC on volume operations and monitor for anomalous detach requests.

How to confirm the fix worked

Review OpenStack component versions and configuration for consistent volume lifecycle handling, replay controlled detach operations in a test environment, and inspect service logs for state mismatches after detach events.

Typical attack path

1. Obtain valid authenticated access to the OpenStack environment
2. Identify a target volume attached via Nova
3. Issue a detach operation through the Cinder API
4. Leverage the resulting inconsistency to access volume data

How to detect it

Examine Cinder and Nova audit logs for volume detach operations performed by non-owner tenants, correlate with subsequent data access attempts, and search service logs for state inconsistency warnings or errors around volume lifecycle events.

What your security team should do

• Prioritize patching Cinder and Nova once fixed versions are released
• Audit and tighten volume detachment permissions for all tenants
• Enable detailed auditing of Cinder and Nova API calls
• Review existing volumes for unintended exposure after any detach operations