Skip to content
Fencer Intel
medium 6.5

CVE-2014-8750 json

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated use…

published 2014-10-15 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-8581

cvss
6.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.

Patch / fix

  • openstack nova 2014.1.4
  • openstack-nova openstack 5 2014.1.3-4.el7ost
  • python-nova openstack 5 2014.1.3-4.el7ost
  • openstack-nova-api openstack 5 2014.1.3-4.el7ost
  • openstack-nova-cert openstack 5 2014.1.3-4.el7ost
  • openstack-nova-cells openstack 5 2014.1.3-4.el7ost
  • openstack-nova-common openstack 5 2014.1.3-4.el7ost
  • openstack-nova-compute openstack 5 2014.1.3-4.el7ost
  • openstack-nova-console openstack 5 2014.1.3-4.el7ost

red hat advisories RHSA-2014:1782RHSA-2014:1781RHSA-2014:1689

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-8750 updated cvss 6.0

openstack-nova: Nova VMware driver may connect VNC to another tenant's console

  • Red Hat Enterprise Linux OpenStack Platform 4.0 python-nova 2013.2.4-2.el6ost, openstack-nova 2013.2.4-2.el6ost, openstack-nova-api 2013.2.4-2.el6ost, openstack-nova-cert 2013.2.4-2.el6ost, openstack-nova-cells 2013.2.4-2.el6ost, openstack-nova-common 2013.2.4-2.el6ost, +7 more
    fixed: vendor fix RHSA-2014:1689
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 python-nova 2014.1.3-4.el6ost, openstack-nova 2014.1.3-4.el6ost, openstack-nova-api 2014.1.3-4.el6ost, openstack-nova-cert 2014.1.3-4.el6ost, openstack-nova-cells 2014.1.3-4.el6ost, openstack-nova-common 2014.1.3-4.el6ost, +7 more
    fixed: vendor fix RHSA-2014:1781
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 python-nova 2014.1.3-4.el7ost, openstack-nova 2014.1.3-4.el7ost, openstack-nova-api 2014.1.3-4.el7ost, openstack-nova-cert 2014.1.3-4.el7ost, openstack-nova-cells 2014.1.3-4.el7ost, openstack-nova-common 2014.1.3-4.el7ost, +7 more
    fixed: vendor fix RHSA-2014:1782

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.