CVE-2017-18191

Name	CVE-2017-18191
Description	An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nova (PTS)	jessie	2014.1.3-11	vulnerable
	stretch (security), stretch (lts), stretch	2:14.0.0-4+deb9u1	vulnerable
	buster (security), buster, buster (lts)	2:18.1.0-6+deb10u2	fixed
	bullseye	2:22.0.1-2+deb11u1	fixed
	bullseye (security)	2:22.4.0-1~deb11u5	fixed
	bookworm (security), bookworm	2:26.2.2-1~deb12u3	fixed
	sid, trixie	2:30.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nova	source	wheezy	(unfixed)	end-of-life
nova	source	(unstable)	2:17.0.0-1

Notes

[stretch] - nova <no-dsa> (Minor issue)
[jessie] - nova <no-dsa> (Minor issue)
[wheezy] - nova <end-of-life> (Not supported in Wheezy)
https://launchpad.net/bugs/1739593
https://review.openstack.org/539893