CVE-2012-3371: OpenStack Nova Scheduler denial of service through scheduler_hints
3.5
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.74386%
CWE
Published
5/17/2022
Updated
11/22/2024
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
AV:N/AC:M/Au:S/C:N/I:N/A:P
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
Nova | pip | < 12.0.0a0 | 12.0.0a0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stemmed from making individual database calls (compute_api.get()) for each UUID in scheduler_hints. The pre-patch implementation in DifferentHostFilter and SameHostFilter's host_passes methods iterated through UUIDs using _affinity_host(), which performed a separate database lookup for each UUID. This created a linear scaling problem where repeated UUIDs would trigger multiple redundant database queries. The commit 034762e replaced this pattern with a bulk lookup (compute_api.get_all()) in _all_hosts(), demonstrating the vulnerable pattern was in these filter methods and their dependency on _affinity_host.