CVE-2020-17376: 
Python vulnerability analysis and mitigation

CVE-2020-17376 is a vulnerability discovered in OpenStack Nova's live migration feature, affecting versions <19.3.1, >=20.0.0 <20.3.1, and 21.0.0. The vulnerability was reported by Tadayoshi Hosoya (NEC) and Lee Yarwood (Red Hat) and disclosed on August 25, 2020. The issue affects the Guest.migrate functionality in virt/libvirt/guest.py in OpenStack Nova (OpenStack Advisory).

The vulnerability occurs when performing a soft reboot of an instance that has previously undergone live migration. The issue stems from Nova not providing VIR_MIGRATE_PARAM_PERSIST_XML during migration, resulting in the original source domain's persistent configuration being used instead of the destination configuration. This affects deployments allowing host-based connections for instance root and ephemeral devices (OSS Security).

When exploited, this vulnerability allows users to gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source. This can include block devices that map to different Cinder volumes at the destination than at the source, potentially leading to unauthorized access to data or data corruption (OpenStack Advisory).

The vulnerability requires specific conditions to be exploited: the instance must have undergone live migration (typically an admin-only operation), and the user must have permission to perform soft reboots. The risk is significantly increased in non-default configurations where untrusted users are allowed to initiate live migrations (OpenStack Advisory).

Until patches can be applied, administrators are recommended to disable soft reboots in policy (only allowing hard reboots) and consider temporarily disabling live migrations for untrusted users. Patches have been provided for multiple OpenStack versions including Pike, Queens, Rocky, Stein, Train, Ussuri, and Victoria (OpenStack Advisory).