Title: Neutron L2 agent DoS through incorrect allowed address pairs Reporter: Darragh O'Reilly (HP) Products: Neutron Affects: 2014.2 versions through 2014.2.3 and 2015.1.0 version Description: Darragh O'Reilly from HP reported a vulnerability in Neutron. By adding an address pair which is rejected as invalid by the ipset tool, an authenticated user may crash the Neutron L2 agent resulting in a denial of service attack. Neutron setups using the IPTables firewall driver are affected. Acknowledgements: Red Hat would like to thank the OpenStack upstream for reporting this issue. Upstream acknowledges Darragh O'Reilly (HP) as the original reporter.
Created attachment 1040537 [details] cve-2015-3221-master-liberty.patch
Created attachment 1040538 [details] cve-2015-3221-stable-juno.patch
Created attachment 1040539 [details] cve-2015-3221-stable-kilo.patch
Some more notes, the kilo and liberty patch are self healing, if a zero prefixed address pair have already been assigned, then it will be fixed when the service restarts. Juno patch on the other hand will block attempt to use zero prefixed address pair and if a zero prefixed address pair have already been assigned, then the script included in the patch needs to be run in order to fix it.
Created openstack-neutron tracking bugs for this issue: Affects: fedora-all [bug 1240145] Affects: openstack-rdo [bug 1240146]
This issue has been addressed in the following products: OpenStack 6 for RHEL 7 Via RHSA-2015:1680 https://rhn.redhat.com/errata/RHSA-2015-1680.html