CVE-2018-14635 OpensStack Neutron Denial of Service Vulnerability
Non-privileged tenants can bypass IP validation in OpenStack Neutron, potentially causing denial of service by assigning conflicting IP addresses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14635?
CVE-2018-14635 is a medium-severity missing authorization vulnerability in Redhat Openstack, published on 10 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.
Weakness: CWE-20
Which versions are affected by CVE-2018-14635?
7 open source packages ship an affected version, including neutron. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | All versions | 11.0.6, 12.0.4 |
neutron PyPI | All versions | 11.0.6 |
neutron PyPI | All versions | 11.0.6 |
neutron PyPI | From 12.0.0 | 12.0.4 |
neutron PyPI | From 12.0.0 | 12.0.4 |
neutron PyPI | From 13.0.0.0b1 | 13.0.0.0b2 |
1 more packages
neutron PyPI | From 13.0.0.0b1 | 13.0.0.0b2 |
Linux distribution packages (32)
openstack-neutron Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-common Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-linuxbridge Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-macvtap-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-metering-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-ml2 Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-openvswitch Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-rpc-server Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
python-neutron Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
python-neutron-tests Red Hat:openstack:10::el7 | All versions | 1:9.4.1-28.el7ost |
openstack-neutron Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-common Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-linuxbridge Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-macvtap-agent Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-metering-agent Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-ml2 Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-openvswitch Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-rpc-server Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
python-neutron Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
python-neutron-tests Red Hat:openstack:12::el7 | All versions | 1:11.0.4-6.el7ost |
openstack-neutron Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-common Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-linuxbridge Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-macvtap-agent Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-metering-agent Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-ml2 Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-openvswitch Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-rpc-server Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
python-neutron Red Hat:openstack:13::el7 | All versions | 1:12.0.3-5.el7ost |
Products include Openstack Neutron, Redhat Openstack.
How do I fix CVE-2018-14635?
Upgrade neutron to a fixed version for your release line: 11.0.6, 12.0.4 or 13.0.0.0b2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-14635 being exploited?
There is no known exploitation of CVE-2018-14635 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
- CVE-2021-38598 OpenStack Neutron vulnerable to hardware address impersonation
- CVE-2015-8914 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
- CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
- CVE-2016-5363 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
- CVE-2014-3632 Privilege escalation in n/a
Sources
Also known as DEBIAN-CVE-2018-14635, GHSA-x634-34m9-96mp, PYSEC-2018-93, RHSA-2018:2710, RHSA-2018:2715, RHSA-2018:3792 and 1 more.