OSSA-2014-014: Neutron security groups bypass through invalid CIDR¶
April 22, 2014
Neutron: 2013.1 to 2013.2.3, and 2014.1
Stephen Ma from Hewlett Packard and Christoph Thiel from Deutsche Telekom reported a vulnerability in Neutron security groups. By creating a security group rule with an invalid CIDR, an authenticated user may break openvswitch-agent process, preventing further rules from being applied on the host. Note: removal of the faulty rule is not enough, the openvswitch-agent must be restarted. All Neutron setups using Open vSwitch are affected.
Stephen Ma from HP (CVE-2014-0187)
Christoph Thiel from Deutsche Telekom (CVE-2014-0187)