Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1473792 - (CVE-2017-7543) CVE-2017-7543 openstack-neutron: iptables not active after update
CVE-2017-7543 openstack-neutron: iptables not active after update
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170808,repo...
: Security
Depends On: 1474113 1474114 1474115 1474116 1474117 1474118 1474119
Blocks: 1473793
  Show dependency tree / graph
 
Reported: 2017-07-21 12:44 EDT by Kurt Seifried
Modified: 2018-10-09 01:10 EDT (History)
27 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-12-13 19:39:16 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
RHOSP7 difffs for three files (593 bytes, text/plain)
2018-10-07 20:14 EDT, Summer Long 		no flags Details
RHOSP7 diff for this CVE (1.72 KB, text/plain)
2018-10-07 20:17 EDT, Summer Long 		no flags Details
Show Obsolete (1) Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2447 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:31:02 EDT
Red Hat Product Errata RHSA-2017:2448 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:30:46 EDT
Red Hat Product Errata RHSA-2017:2449 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:30:34 EDT
Red Hat Product Errata RHSA-2017:2450 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:29:56 EDT
Red Hat Product Errata RHSA-2017:2451 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:29:29 EDT
Red Hat Product Errata RHSA-2017:2452 normal SHIPPED_LIVE Important: openstack-neutron security update 2017-08-08 22:50:56 EDT

  None (edit)
Description Kurt Seifried 2017-07-21 12:44:58 EDT 
Paul Needle of Red Hat reports:

iptables/firewalld is not active on overcloud compute and controller nodes, following an 'openstack overcloud update ...' procedure run in a production environment yesterday. This has major impact given that there are end-customer workloads running in this environment.
Comment 1 Summer Long 2017-07-23 18:10:40 EDT 
Acknowledgements:

Name: Paul Needle (Red Hat)
Comment 4 Ihar Hrachyshka 2017-07-25 11:40:41 EDT 
All bugs except OSP12 are in MODIFIED now. OSP12 will get the fix through regular RDO sync process (we can leave it without a OSP fix for the time being because it was not released yet).
Comment 5 Summer Long 2017-07-25 19:10:48 EDT 
Mitigation:

To determine whether your system is impacted, run:
$ sudo sysctl net.bridge.bridge-nf-call-ip6tables 
$ sudo sysctl net.bridge.bridge-nf-call-iptables
Both should be set to 1

To reset security groups to '1':
1. Apply the following configuration modification:
$ sudo sed -i.back -e 's/reapply_sysctl = 0/reapply_sysctl = 1/' /etc/tuned/tuned-main.conf

2. Ensure the modification was successful:
$ grep reapply_sysctl /etc/tuned/tuned-main.conf
should be "reapply_sysctl = 1"

3. Check whether tuned is running:
$ sudo systemctl status tuned

4. Restart tuned to apply the new configuration:
$ sudo systemctl restart tuned

5. Recheck your security groups and the status of 'reapply_sysctl'.
Comment 11 errata-xmlrpc 2017-08-08 18:31:43 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2017:2451 https://access.redhat.com/errata/RHSA-2017:2451
Comment 12 errata-xmlrpc 2017-08-08 18:32:13 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2017:2450 https://access.redhat.com/errata/RHSA-2017:2450
Comment 13 errata-xmlrpc 2017-08-08 18:32:40 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 (Ocata)

Via RHSA-2017:2449 https://access.redhat.com/errata/RHSA-2017:2449
Comment 14 errata-xmlrpc 2017-08-08 18:33:05 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:2448 https://access.redhat.com/errata/RHSA-2017:2448
Comment 15 errata-xmlrpc 2017-08-08 18:33:35 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 9.0 (Mitaka)

Via RHSA-2017:2447 https://access.redhat.com/errata/RHSA-2017:2447
Comment 16 errata-xmlrpc 2017-08-08 18:51:34 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2017:2452 https://access.redhat.com/errata/RHSA-2017:2452
Comment 17 Suraj Chandegave 2018-10-05 09:03:55 EDT 
Hi,

I checked the errata https://access.redhat.com/errata/RHSA-2017:2450 to get fix for vulnerability CVE-2017-7543 for openstack kilo, but it says to update the openstack-neutron rpm package. Can I get access to specific code fix made to fix this vulnerability?

Thanks.
Comment 18 Summer Long 2018-10-07 20:14 EDT 
Created attachment 1491473 [details]
RHOSP7 difffs for three files
Comment 19 Summer Long 2018-10-07 20:17 EDT 
Created attachment 1491474 [details]
RHOSP7 diff for this CVE
Comment 20 Summer Long 2018-10-07 20:23:35 EDT 
Hi Suraj, Because this flaw only impacts Red Hat OpenStack Platform versions and not upstream, I can't offer an upstream code link. However, I have attached a file to this bug with a diff of the Red Hat updates (matching the errata you quoted). 
Hope this helps, Summer
Comment 21 Suraj Chandegave 2018-10-09 01:10:47 EDT 
Thanks Summer. This helped.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.