I agree with ttx here, without a way to make the migration process fail, this is a bug with security consequence, but not a vulnerability.
@Hahyun, is there a missing steps that an attacker can use to make the live migration (step 8) failed ?
Else let's triage this as a class D type of report and remove the advisory task. ( https://wiki.openstack.org/wiki/Vulnerability_Management#Incident_report_taxonomy )
I agree with ttx here, without a way to make the migration process fail, this is a bug with security consequence, but not a vulnerability.
@Hahyun, is there a missing steps that an attacker can use to make the live migration (step 8) failed ?
Else let's triage this as a class D type of report and remove the advisory task. ( https:/ /wiki.openstack .org/wiki/ Vulnerability_ Management# Incident_ report_ taxonomy )