|Summary:||CVE-2018-14635 openstack-neutron: A router interface out of subnet IP range results in a denial of service|
|Product:||[Other] Security Response||Reporter:||Andrej Nemec <anemec>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||amuller, apevec, chrisw, dbecker, jamsmith, jjoyce, jpadman, jschluet, kbasil, lhh, lpeer, markmc, mburns, rbryant, sclewis, scohen, slinaber, srevivo, tdecacqu|
|Fixed In Version:||openstack-neutron 22.214.171.124b2, openstack-neutron 12.0.3, openstack-neutron 11.0.5||Doc Type:||If docs needed, set a value|
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool.
|Last Closed:||2019-06-10 10:34:12 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||1607824, 1608084, 1608085, 1608086, 1608087, 1608088, 1608089, 1608090|
Description Andrej Nemec 2018-07-24 11:02:35 UTC
It was found that a non privileged tenant can add a router interface to a shared / external network's subnet with an IP address outside the subnet's allocation pool. This can result in a Denial of Service. Upstream issue: https://bugs.launchpad.net/neutron/+bug/1757482 Upstream patch: https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d
Comment 1 Andrej Nemec 2018-07-24 11:03:04 UTC
Created openstack-neutron tracking bugs for this issue: Affects: openstack-rdo [bug 1607824]
Comment 2 Assaf Muller 2018-07-24 14:27:29 UTC
Hi Andrej, The fix has been merged to the upstream master branch and backports were proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a downstream only backport to OSP 10. Were you going to open RHBZs on openstack-neutron branches 10 to 13?
Comment 3 Andrej Nemec 2018-07-24 14:30:33 UTC
(In reply to Assaf Muller from comment #2) > Hi Andrej, > > The fix has been merged to the upstream master branch and backports were > proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a > downstream only backport to OSP 10. Were you going to open RHBZs on > openstack-neutron branches 10 to 13? Hi Assaf, I have been asked to open the flaw by Joshua Padman. I believe that our Openstack analysis team will get to this shortly and open the relevant trackers. I'll leave it up to their analysis to figure out which of our OSPs need the backports.
Comment 4 James Hebden 2018-07-24 23:02:43 UTC
RHOSP 7.0 through 14.0 all exhibit this behaviour, so I am creating RHBZs for those versions, with the goal of downstream backports being performed for those releases too. In RHOSP 9.0 through 13.0, the function _validate_router_port_info is addressed by the linked upstream patch in OpenStack gerrit, potentially with small adjustments so everything applies cleanly. In addition, the neutron In RHOSP 7.0 and 8.0, the function _validate_router_port_info (which the upstream patches apply to) in db/l3_db.py had not been introduced, so does not exist in 7.0 and 8.0's l3_db.py - the simple validation logic is however consolidated in the _add_interface_by_port function in these older releases. Given no similar protection logic is present in these releases, I suggest that in order to address this for those releases, additional backporting work would be required to add validation to _add_interface_by_port.
Comment 6 Joshua Padman 2018-07-25 04:07:47 UTC
Clearing my needinfo as James has suitably answered the query.
Comment 13 errata-xmlrpc 2018-09-17 16:46:50 UTC
This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2018:2710 https://access.redhat.com/errata/RHSA-2018:2710
Comment 14 errata-xmlrpc 2018-09-17 16:52:13 UTC
This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:2715 https://access.redhat.com/errata/RHSA-2018:2715