OpenStack Nova
CVE-2013-0335
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as tenant user
-
DeliveryRequest VNC console token for own VM
-
ExploitWait for VM to be deleted (or trigger deletion)
-
ExecutionNova recycles VNC port to new tenant VM
-
PersistSubmit stale token to VNC proxy
-
ImpactGain interactive console access to victim VM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Permission and access control
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated OpenStack tenant user (confirmed by CVSS PR:L) who holds a still-valid VNC token issued for a VM that has since been deleted. The critical precondition is that the VNC port previously assigned to the deleted VM must be reallocated to a new VM before the token expires - a timing-dependent condition the CVE description explicitly calls 'opportunistic.' Exploitation is limited to Nova deployments running Essex 2012.1, Folsom 2012.2, or Grizzly 2012.2 with the VNC proxy feature enabled; environments that disable the Nova VNC proxy are not affected. The attack does not work if the deleted VM's VNC port is not promptly recycled to another VM, making exploitation non-deterministic. Authentication as a valid tenant (not a guest or anonymous user) is required, and the attacker must time their token submission during the port-recycling window. |
| Impact | The NVD-assigned CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) rates attack complexity as Low, but this conflicts with the CVE description's explicit framing of exploitation as requiring 'opportunistic circumstances' - a timing dependency on VNC port recycling that AC:L understates. The I:H rating is appropriate given that VNC console access yields full interactive control of the target VM. The C:L rating likely underweights the actual confidentiality impact since console access typically exposes all VM contents. The EPSS score of 1.04% (77th percentile) is consistent with the opportunistic, timing-dependent nature and the EOL status of the affected releases. No CISA KEV listing and no public exploit code have been identified at time of analysis. In active multi-tenant cloud environments running these legacy releases, the tenant-isolation breach potential elevates practical risk above what the low EPSS score alone suggests - but the combination of required authentication, timing dependency, and EOL product status significantly limits the realistic attack surface today. |
| Exploit ScenarioDerived | An authenticated tenant user requests VNC console access to their own VM and receives a valid token. An administrator then deletes that VM. If Nova recycles the freed VNC port to a new VM - belonging to a different tenant - before the original token expires, the first user can submit their stale token to the VNC proxy and gain full interactive console access to the second tenant's running VM without any further authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
VNC token lifecycle mismanagement in OpenStack Nova (Essex 2012.1, Folsom 2012.2, Grizzly 2012.2) allows an authenticated tenant user to gain unauthorized interactive console access to another tenant's running VM under opportunistic timing conditions. When a VM is deleted, Nova fails to invalidate its associated VNC token; if the VNC port is subsequently recycled to a new VM, the stale token becomes valid for that new VM, breaking tenant isolation. No public exploit has been identified at time of analysis, and the EPSS score of 1.04% (77th percentile) reflects limited real-world exploitation, consistent with the timing-dependent nature of the attack and the end-of-life status of all affected releases.
RemediationAI
Apply the vendor-released patches for affected Nova releases; Ubuntu users should follow USN-1771-1 (http://www.ubuntu.com/usn/USN-1771-1) and Red Hat users should apply RHSA-2013-0709 (http://rhn.redhat.com/errata/RHSA-2013-0709.html). Upstream OpenStack fixes are tracked via Launchpad bug 1125378 and implemented in OpenStack Gerrit reviews 22086, 22758, and 22872 (https://review.openstack.org). The exact patched release version is not independently stated in the available references beyond these upstream review links - treat these as upstream fix commits rather than a confirmed tagged release. As a compensating control where immediate patching is not feasible, operators can restrict VNC proxy access to only the originating tenant's network segment, reducing the window for stale token reuse; note this does not eliminate the underlying token invalidation defect and adds operational overhead. Because Essex, Folsom, and Grizzly are all end-of-life releases, migration to a supported OpenStack release is the recommended long-term remediation.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenStack Nova is the IaaS compute service responsible for VM lifecycle management, including brokering VNC console access via a proxy that issues ephemeral per-user tokens. The root cause, classified under CWE-264 (Permissions, Privileges, and Access Controls), is the failure to invalidate or revoke VNC tokens upon VM deletion. VNC port assignments are drawn from a finite pool and recycled; when a deleted VM's port is reallocated to a subsequent VM, any outstanding token referencing the original port silently becomes valid for the new VM. CPE data confirms the affected components as cpe:2.3:a:openstack:essex:2012.1, cpe:2.3:a:openstack:folsom:2012.2, and cpe:2.3:a:openstack:grizzly:2012.2, along with Ubuntu Linux distributions 11.10, 12.04 LTS, and 12.10 that shipped these Nova versions.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
AC:H reflects opportunistic timing dependency on VNC port recycling; C:H and I:H reflect full VM console access; A:N as no availability impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
Executive ViewAI
OpenStack Nova versions Essex, Folsom, and Grizzly contain a tenant isolation vulnerability (CVE-2013-0335) that allows authenticated tenant users to gain console access to other tenants' virtual machines under specific timing conditions. While exploitation requires precise timing and affects end-of-life releases with minimal observed real-world exploitation (EPSS 1.0%), the vulnerability directly undermines multi-tenant isolation guarantees critical to cloud service security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)NVD
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Exploit-DB