[OSSA 2015-001] L3 agent DoS vulnerability (CVE-2014-8153)
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Security Advisory |
Fix Released
|
Medium
|
Unassigned | ||
| neutron |
Fix Released
|
Undecided
|
Unassigned | ||
| Icehouse |
Invalid
|
Undecided
|
Unassigned | ||
| Juno |
Fix Committed
|
Undecided
|
Unassigned | ||
Bug Description
Reported by Ihar Hrachyshka via email:
we've found a bug [1] in Openstack Neutron Juno (2014.2) release that
(it seems) may be utilized to make Neutron L3 agent non-functional
during the following scenario (initially reported in downstream as [2]):
- a tenant (user) creates 8 routers;
- for each router, a tenant assigns a ipv6 non-provider subnet.
=> L3 agent limits the number of threads that process updates to
router state to 8 [3]. Since the bug makes the thread lock if the
release is used with radvd 2.0+, it's enough to have those 8 failing
routers to completely block any kind of router updates processing for
all tenants.
The vulnerability is limited to setups that run on top of radvd 2.0+.
There are few distributions that currently ship radvd 2.0+,
so the scope of the vulnerability is not very wide (in Red Hat world,
it's mostly Fedora Rawhide).
The bug in question is public, though I haven't raised its potential
security status in any public or private communications before.
[1]: https:/
[2]: https:/
[3]: https:/
CVE References
| Changed in ossa: | |
| status: | New → Incomplete |
| Salvatore Orlando (salvatore-orlando) wrote | #1 |
| Thierry Carrez (ttx) wrote | #2 |
| Changed in ossa: | |
| importance: | Undecided → Medium |
| status: | Incomplete → Confirmed |
| Thierry Carrez (ttx) wrote | #3 |
| Changed in neutron: | |
| status: | New → In Progress |
| Ihar Hrachyshka (ihar-hrachyshka) wrote | #4 |
| Ihar Hrachyshka (ihar-hrachyshka) wrote | #5 |
| Tristan Cacqueray (tristan-cacqueray) wrote | #6 |
| Grant Murphy (gmurphy) wrote | #7 |
| Thierry Carrez (ttx) wrote | #8 |
| Changed in ossa: | |
| status: | Confirmed → Triaged |
| Changed in neutron: | |
| status: | In Progress → Fix Committed |
| Tristan Cacqueray (tristan-cacqueray) wrote | #9 |
| Thierry Carrez (ttx) wrote | #10 |
| summary: |
- L3 agent DoS vulnerability + L3 agent DoS vulnerability (CVE-2014-8153) |
| Changed in ossa: | |
| status: | Triaged → In Progress |
| Ihar Hrachyshka (ihar-hrachyshka) wrote Re: L3 agent DoS vulnerability (CVE-2014-8153) | #11 |
| Tristan Cacqueray (tristan-cacqueray) wrote | #12 |
| Changed in ossa: | |
| status: | In Progress → Fix Committed |
| information type: | Private Security → Public Security |
| summary: |
- L3 agent DoS vulnerability (CVE-2014-8153) + [OSSA 2015-001] L3 agent DoS vulnerability (CVE-2014-8153) |
| Changed in ossa: | |
| status: | Fix Committed → Fix Released |
| OpenStack Infra (hudson-openstack) wrote Related fix merged to ossa (master) | #13 |
| Changed in neutron: | |
| milestone: | none → kilo-2 |
| status: | Fix Committed → Fix Released |
| Changed in neutron: | |
| milestone: | kilo-2 → 2015.1.0 |
The security implication seems appropriate. I have not reproduced it, but looking at the code it is pretty obvious what will happen with the different behaviour of radvd 2