CVE-2022-37394: 
Python vulnerability analysis and mitigation

CVE-2022-37394 is a vulnerability discovered in OpenStack Nova affecting versions before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. The vulnerability was reported by Balazs Gibizer from Red Hat and involves Nova's restart behavior when a Neutron port type is changed from 'direct' to 'macvtap' (Launchpad Bug).

The vulnerability occurs in OpenStack Nova's handling of vnic_type changes. When a neutron port with vnic_type 'direct' is created and bound to an instance, and then the vnic_type is changed to 'macvtap', the compute service attempts to plug the vif of the changed port during _init_instance. However, since the port now has macvtap vnic_type, Nova tries to look up the netdev of the parent VF, which is still consumed by the instance, resulting in a failure to find the netdev on the host OS (Red Hat Advisory).

The vulnerability can cause the compute service to fail to restart, potentially resulting in a denial of service condition. This affects only Nova deployments configured with SR-IOV. The impact is considered low severity according to Red Hat's assessment (Red Hat Advisory).

The vulnerability can be exploited by any authenticated user, not just operator-level accounts. An attacker can trigger the vulnerability by creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap (Launchpad Bug).

The issue has been fixed in OpenStack Nova versions 23.2.2, 24.1.2, and 25.0.2. The fix includes adding an exception handler that logs an ERROR and continues initializing other instances on the host when the vnic_type change is detected. Additionally, a detailed ERROR log is added when Nova detects the vnic_type change during _heal_instance_info_cache periodic (Launchpad Bug).