Bug 1607822 (CVE-2018-14635)

Summary: CVE-2018-14635 openstack-neutron: A router interface out of subnet IP range results in a denial of service
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amuller, apevec, chrisw, dbecker, jamsmith, jjoyce, jpadman, jschluet, kbasil, lhh, lpeer, markmc, mburns, rbryant, sclewis, scohen, slinaber, srevivo, tdecacqu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openstack-neutron 13.0.0.0b2, openstack-neutron 12.0.3, openstack-neutron 11.0.5 Doc Type: If docs needed, set a value
Doc Text:
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:34:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1607824, 1608084, 1608085, 1608086, 1608087, 1608088, 1608089, 1608090    
Bug Blocks: 1607826    

Description Andrej Nemec 2018-07-24 11:02:35 UTC
It was found that a non privileged tenant can add a router interface to a shared / external network's subnet with an IP address outside the subnet's allocation pool. This can result in a Denial of Service.

Upstream issue:

https://bugs.launchpad.net/neutron/+bug/1757482

Upstream patch:

https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d

Comment 1 Andrej Nemec 2018-07-24 11:03:04 UTC
Created openstack-neutron tracking bugs for this issue:

Affects: openstack-rdo [bug 1607824]

Comment 2 Assaf Muller 2018-07-24 14:27:29 UTC
Hi Andrej,

The fix has been merged to the upstream master branch and backports were proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a downstream only backport to OSP 10. Were you going to open RHBZs on openstack-neutron branches 10 to 13?

Comment 3 Andrej Nemec 2018-07-24 14:30:33 UTC
(In reply to Assaf Muller from comment #2)
> Hi Andrej,
> 
> The fix has been merged to the upstream master branch and backports were
> proposed in Ocata to Queens (equiv. to OSP 11 to 13). We'll need to do a
> downstream only backport to OSP 10. Were you going to open RHBZs on
> openstack-neutron branches 10 to 13?

Hi Assaf,

I have been asked to open the flaw by Joshua Padman. I believe that our Openstack analysis team will get to this shortly and open the relevant trackers. I'll leave it up to their analysis to figure out which of our OSPs need the backports.

Comment 4 James Hebden 2018-07-24 23:02:43 UTC
RHOSP 7.0 through 14.0 all exhibit this behaviour, so I am creating RHBZs for those versions, with the goal of downstream backports being performed for those releases too.
In RHOSP 9.0 through 13.0, the function _validate_router_port_info is addressed by the linked upstream patch in OpenStack gerrit, potentially with small adjustments so everything applies cleanly. In addition, the neutron
In RHOSP 7.0 and 8.0, the function _validate_router_port_info (which the upstream patches apply to) in db/l3_db.py had not been introduced, so does not exist in 7.0 and 8.0's l3_db.py - the simple validation logic is however consolidated in the _add_interface_by_port function in these older releases. Given no similar protection logic is present in these releases, I suggest that in order to address this for those releases, additional backporting work would be required to add validation to _add_interface_by_port.

Comment 6 Joshua Padman 2018-07-25 04:07:47 UTC
Clearing my needinfo as James has suitably answered the query.

Comment 13 errata-xmlrpc 2018-09-17 16:46:50 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)

Via RHSA-2018:2710 https://access.redhat.com/errata/RHSA-2018:2710

Comment 14 errata-xmlrpc 2018-09-17 16:52:13 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2018:2715 https://access.redhat.com/errata/RHSA-2018:2715

Comment 15 errata-xmlrpc 2018-12-05 18:52:30 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 12.0 (Pike)

Via RHSA-2018:3792 https://access.redhat.com/errata/RHSA-2018:3792