OSSA-2021-005: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts

Date:

August 31, 2021

CVE:

CVE-2021-40085

Affects

• Neutron: <16.4.1, >=17.0.0 <17.2.1, >=18.0.0 <18.1.1

Description

Pavel Toporkov reported a vulnerability in Neutron. By supplying a specially crafted extra_dhcp_opts value, an authenticated user may add arbitrary configuration to the dnsmasq process in order to crash the service, change parameters for other tenants sharing the same interface, or otherwise alter that daemon’s behavior. This vulnerability may also be used to trigger a configuration parsing buffer overflow in versions of dnsmasq prior to 2.81, which could lead to remote code execution. All Neutron deployments are affected.

Patches

• https://review.opendev.org/806709 (Queens)

• https://review.opendev.org/806862 (Rocky)

• https://review.opendev.org/806708 (Stein)

• https://review.opendev.org/806707 (Train)

• https://review.opendev.org/806750 (Ussuri)

• https://review.opendev.org/806749 (Victoria)

• https://review.opendev.org/806748 (Wallaby)

• https://review.opendev.org/806746 (Xena)

Credits

• Pavel Toporkov (CVE-2021-40085)

References

• https://launchpad.net/bugs/1939733

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40085

Notes

• The stable/train, stable/stein, stable/rocky, and stable/queens branches are under extended maintenance and will receive no new point releases, but patches for them are provided as a courtesy.