Bug 1607822 (CVE-2018-14635)
| Summary: | CVE-2018-14635 openstack-neutron: A router interface out of subnet IP range results in a denial of service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amuller, apevec, chrisw, dbecker, jamsmith, jjoyce, jpadman, jschluet, kbasil, lhh, lpeer, markmc, mburns, rbryant, sclewis, scohen, slinaber, srevivo, tdecacqu |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openstack-neutron 13.0.0.0b2, openstack-neutron 12.0.3, openstack-neutron 11.0.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:34:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1607824, 1608084, 1608085, 1608086, 1608087, 1608088, 1608089, 1608090 | ||
| Bug Blocks: | 1607826 | ||
|
Description
Andrej Nemec
2018-07-24 11:02:35 UTC
Created openstack-neutron tracking bugs for this issue: Affects: openstack-rdo [bug 1607824] Hi Andrej, The fix has been merged to the upstream master branch and backports were proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a downstream only backport to OSP 10. Were you going to open RHBZs on openstack-neutron branches 10 to 13? (In reply to Assaf Muller from comment #2) > Hi Andrej, > > The fix has been merged to the upstream master branch and backports were > proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a > downstream only backport to OSP 10. Were you going to open RHBZs on > openstack-neutron branches 10 to 13? Hi Assaf, I have been asked to open the flaw by Joshua Padman. I believe that our Openstack analysis team will get to this shortly and open the relevant trackers. I'll leave it up to their analysis to figure out which of our OSPs need the backports. RHOSP 7.0 through 14.0 all exhibit this behaviour, so I am creating RHBZs for those versions, with the goal of downstream backports being performed for those releases too. In RHOSP 9.0 through 13.0, the function _validate_router_port_info is addressed by the linked upstream patch in OpenStack gerrit, potentially with small adjustments so everything applies cleanly. In addition, the neutron In RHOSP 7.0 and 8.0, the function _validate_router_port_info (which the upstream patches apply to) in db/l3_db.py had not been introduced, so does not exist in 7.0 and 8.0's l3_db.py - the simple validation logic is however consolidated in the _add_interface_by_port function in these older releases. Given no similar protection logic is present in these releases, I suggest that in order to address this for those releases, additional backporting work would be required to add validation to _add_interface_by_port. Clearing my needinfo as James has suitably answered the query. This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2018:2710 https://access.redhat.com/errata/RHSA-2018:2710 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:2715 https://access.redhat.com/errata/RHSA-2018:2715 This issue has been addressed in the following products: Red Hat OpenStack Platform 12.0 (Pike) Via RHSA-2018:3792 https://access.redhat.com/errata/RHSA-2018:3792 |