CVE-2021-40797 OpenStack Neutron Denial of Service vulnerability
An authenticated user can cause memory exhaustion and denial of service in OpenStack Neutron API workers by requesting nonexistent controllers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-40797?
CVE-2021-40797 is a medium-severity denial of service vulnerability in n/a, published on 8 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.
Weakness: CWE-772
Which versions are affected by CVE-2021-40797?
7 open source packages ship an affected version, including neutron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | All versions | 16.4.1, 17.2.1, 18.1.1 |
neutron PyPI | All versions | 16.4.1 |
neutron PyPI | All versions | 16.4.1 |
neutron PyPI | From 17.0.0 | 17.2.1 |
neutron PyPI | From 17.0.0 | 17.2.1 |
neutron PyPI | From 18.0.0 | 18.1.1 |
1 more packages
neutron PyPI | From 18.0.0 | 18.1.1 |
Linux distribution packages (20)
openstack-neutron Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-common Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-linuxbridge Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-macvtap-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-metering-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-ml2 Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-openvswitch Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-rpc-server Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
python3-neutron Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20220112133420.el8ost |
openstack-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-common Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-linuxbridge Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-macvtap-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-metering-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-ml2 Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-openvswitch Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-rpc-server Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
python3-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20220113150031.el8ost |
Products include Openstack Neutron.
How do I fix CVE-2021-40797?
Upgrade neutron to a fixed version for your release line: 16.4.1, 17.2.1 or 18.1.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-40797 being exploited?
There is no known exploitation of CVE-2021-40797 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-38598 OpenStack Neutron vulnerable to hardware address impersonation
- CVE-2015-8914 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
- CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
- CVE-2016-5363 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
- CVE-2014-3632 Privilege escalation in n/a
Sources
Also known as DEBIAN-CVE-2021-40797, GHSA-cpx3-696p-3cw9, PYSEC-2021-329, RHSA-2022:0990, RHSA-2022:0996, UBUNTU-CVE-2021-40797.