OSSA-2015-001: L3 agent denial of service with radvd 2.0+

Date:

January 08, 2015

CVE:

CVE-2014-8153

Affects

• Neutron: 2014.2 version up to 2014.2.1

Description

Ihar Hrachyshka from Red Hat reported a vulnerability in Neutron. By creating 8 routers and assigning each of them a non-provider ipv6 subnet, a malicious user may block router update processing for all tenants, potentially resulting in a Denial of Service. Only Neutron setups running with radvd 2.0+ are affected.

Patches

• https://review.openstack.org/141575 (Juno)

• https://review.openstack.org/138688 (Kilo)

Credits

• Ihar Hrachyshka from Red Hat (CVE-2014-8153)

References

• https://launchpad.net/bugs/1399172

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8153

Notes

• This fix will be included in a future 2014.2.2 release.

• The OSSA announce format for the 2015 advisories has been changed to RST.