CVE-2023-3637

What it actually does

Uncontrolled resource consumption via repeated queries for security group lists using invalid projects that bypass quota enforcement, allowing unbounded resource allocation by authenticated users.

Why it matters to the business

Attackers can exhaust cloud networking resources leading to denial of service, degraded performance, and operational downtime for dependent services and users.

How an attack unfolds

An authenticated remote attacker repeatedly submits list security group requests specifying invalid projects; each request allocates resources without quota limits, and a high volume of such requests starves the system of capacity resulting in denial of service.

How to fix it

Upgrade affected packages to fixed versions: stefanberger/swtpm (GIT) to commit 2df14e343b43ea576e0f8cc106670303446682ac or swtpm (Ubuntu 22.04 LTS) to 0.6.3-0ubuntu3. Apply vendor patches for openstack-neutron if applicable and enforce strict input validation on project identifiers.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases, test that invalid project queries now return appropriate errors without resource allocation, and confirm quota enforcement applies to all security group listing operations.

Typical attack path

1. Obtain valid credentials for an account in the OpenStack environment
2. Craft API requests that list security groups for deliberately invalid project identifiers
3. Submit large numbers of these requests in rapid succession
4. Monitor for resource exhaustion and service unavailability

How to detect it

Review API access logs for high volumes of security group list requests referencing non-existent projects, correlate with spikes in memory or CPU usage on neutron API nodes, and inspect authentication events for patterns from single user accounts.

What your security team should do

• Prioritize patching to the fixed versions within the next maintenance window due to the age of the disclosure
• Implement API rate limiting and input sanitization for project identifiers in neutron services
• Monitor resource usage metrics for anomalous consumption patterns from authenticated users
• Review and tighten project quota configurations across the deployment