Bug 1473792 (CVE-2017-7543)
| Summary: | CVE-2017-7543 openstack-neutron: iptables not active after update | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | unspecified | CC: | amuller, aortega, apevec, astafeye, chrisw, cvsbot-xmlrpc, ekuris, gcheresh, hbrock, ihrachys, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mburns, morazi, nyechiel, rbryant, sclewis, security-response-team, slinaber, slong, srevivo, suraj.chandegave, tdecacqu | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: |
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2017-12-14 00:39:16 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 1474113, 1474114, 1474115, 1474116, 1474117, 1474118, 1474119 | ||||||||
| Bug Blocks: | 1473793 | ||||||||
| Attachments: |
|
||||||||
|
Description
Kurt Seifried
2017-07-21 16:44:58 UTC
Acknowledgements: Name: Paul Needle (Red Hat) All bugs except OSP12 are in MODIFIED now. OSP12 will get the fix through regular RDO sync process (we can leave it without a OSP fix for the time being because it was not released yet). Mitigation: To determine whether your system is impacted, run: $ sudo sysctl net.bridge.bridge-nf-call-ip6tables $ sudo sysctl net.bridge.bridge-nf-call-iptables Both should be set to 1 To reset security groups to '1': 1. Apply the following configuration modification: $ sudo sed -i.back -e 's/reapply_sysctl = 0/reapply_sysctl = 1/' /etc/tuned/tuned-main.conf 2. Ensure the modification was successful: $ grep reapply_sysctl /etc/tuned/tuned-main.conf should be "reapply_sysctl = 1" 3. Check whether tuned is running: $ sudo systemctl status tuned 4. Restart tuned to apply the new configuration: $ sudo systemctl restart tuned 5. Recheck your security groups and the status of 'reapply_sysctl'. This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) Via RHSA-2017:2451 https://access.redhat.com/errata/RHSA-2017:2451 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2017:2450 https://access.redhat.com/errata/RHSA-2017:2450 This issue has been addressed in the following products: Red Hat OpenStack Platform 11.0 (Ocata) Via RHSA-2017:2449 https://access.redhat.com/errata/RHSA-2017:2449 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2017:2448 https://access.redhat.com/errata/RHSA-2017:2448 This issue has been addressed in the following products: Red Hat OpenStack Platform 9.0 (Mitaka) Via RHSA-2017:2447 https://access.redhat.com/errata/RHSA-2017:2447 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2017:2452 https://access.redhat.com/errata/RHSA-2017:2452 Hi, I checked the errata https://access.redhat.com/errata/RHSA-2017:2450 to get fix for vulnerability CVE-2017-7543 for openstack kilo, but it says to update the openstack-neutron rpm package. Can I get access to specific code fix made to fix this vulnerability? Thanks. Created attachment 1491473 [details]
RHOSP7 difffs for three files
Created attachment 1491474 [details]
RHOSP7 diff for this CVE
Hi Suraj, Because this flaw only impacts Red Hat OpenStack Platform versions and not upstream, I can't offer an upstream code link. However, I have attached a file to this bug with a diff of the Red Hat updates (matching the errata you quoted). Hope this helps, Summer Thanks Summer. This helped. |