CVE-2015-3221: OpenStack Neutron denial of service in IPTables firewall driver

Executive brief

OpenStack Neutron, a networking service for cloud environments, is vulnerable to a denial-of-service attack. An authenticated user can cause the networking agent to crash by providing specific network address pairs that the system's firewall tools cannot process. This can disrupt network connectivity and management operations within the cloud environment.

Technical details

An improper input validation vulnerability (CWE-20) exists in OpenStack Neutron when configured with the IPTables firewall driver. Remote authenticated users can trigger a denial of service by adding an allowed-address-pair that is rejected by the underlying 'ipset' tool, leading to a crash of the L2 agent. The issue affects Neutron versions before 2014.2.4 (Juno) and 2015.1.x before 2015.1.1 (Kilo). Patches are available in versions 2014.2.4 and 2015.1.1.

Affected products

• OpenStack Neutron >= 2015.1.0, < 2015.1.1; >= 2000, < 2014.2.4

Timeline

• 2015-06-17: advisory: OpenStack security advisory issued
• 2015-08-26: disclosed: NVD publication date
• 2022-05-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/cardoe
• https://github.com/cardoe
• https://api.github.com/users/cardoe/gists%7B/gist_id%7D
• https://api.github.com/users/cardoe/repos
• https://avatars.githubusercontent.com/u/8839?v=4
• https://api.github.com/users/cardoe/events%7B/privacy%7D