Bug 1232284 – CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1232284 - (CVE-2015-3221) CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs

Summary:	CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed addre...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-3221

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150623,repor...
Keywords:	Security

Depends On:	1233450 1234263 1240145 1240146
Blocks:	1232286
	Show dependency tree / graph

Reported:	2015-06-16 08:27 EDT by Vasyl Kaigorodov
Modified:	2016-04-26 14:53 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	A Denial-of-Service flaw was found in the OpenStack Networking (neutron) L2 agent when using the iptables firewall driver. By submitting an address pair that is rejected as invalid by the ipset tool (with zero prefix size), an authenticated attacker can cause the L2 agent to crash.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-08-26 00:43:14 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
cve-2015-3221-master-liberty.patch (4.86 KB, text/plain) 2015-06-18 11:41 EDT, Vasyl Kaigorodov	no flags	Details
cve-2015-3221-stable-juno.patch (6.31 KB, text/plain) 2015-06-18 11:42 EDT, Vasyl Kaigorodov	no flags	Details
cve-2015-3221-stable-kilo.patch (5.12 KB, text/plain) 2015-06-18 11:42 EDT, Vasyl Kaigorodov	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Launchpad	1461054	None	None	None	Never
Red Hat Product Errata	RHSA-2015:1680	normal	SHIPPED_LIVE	Moderate: openstack-neutron security and bug fix update	2015-08-24 20:12:31 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2015-06-16 08:27:30 EDT

Title: Neutron L2 agent DoS through incorrect allowed address pairs
Reporter: Darragh O'Reilly (HP)
Products: Neutron
Affects: 2014.2 versions through 2014.2.3 and 2015.1.0 version

Description:
Darragh O'Reilly from HP reported a vulnerability in Neutron. By adding
an address pair which is rejected as invalid by the ipset tool, an
authenticated user may crash the Neutron L2 agent resulting in a denial
of service attack. Neutron setups using the IPTables firewall driver are
affected.

Acknowledgements:

Red Hat would like to thank the OpenStack upstream for reporting this issue. Upstream acknowledges Darragh O'Reilly (HP) as the original reporter.

Comment 1 Vasyl Kaigorodov 2015-06-18 11:41:59 EDT

Created attachment 1040537 [details]
cve-2015-3221-master-liberty.patch

Comment 2 Vasyl Kaigorodov 2015-06-18 11:42:03 EDT

Created attachment 1040538 [details]
cve-2015-3221-stable-juno.patch

Comment 3 Vasyl Kaigorodov 2015-06-18 11:42:06 EDT

Created attachment 1040539 [details]
cve-2015-3221-stable-kilo.patch

Comment 6 Tristan Cacqueray 2015-06-19 16:10:57 EDT

Some more notes, the kilo and liberty patch are self healing, if a zero prefixed address pair have already been assigned, then it will be fixed when the service restarts.

Juno patch on the other hand will block attempt to use zero prefixed address pair and if a zero prefixed address pair have already been assigned, then the script included in the patch needs to be run in order to fix it.

Comment 8 Garth Mollett 2015-07-06 01:19:27 EDT

Created openstack-neutron tracking bugs for this issue:

Affects: fedora-all [bug 1240145]
Affects: openstack-rdo [bug 1240146]

Comment 10 errata-xmlrpc 2015-08-24 16:15:43 EDT

This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2015:1680 https://rhn.redhat.com/errata/RHSA-2015-1680.html

Note You need to log in before you can comment on or make changes to this bug.