CVE-2022-3277 openstack-neutron uncontrolled resource consumption flaw
A remote authenticated user can cause denial of service in OpenStack Neutron by querying invalid projects to create unconstrained resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3277?
CVE-2022-3277 is a medium-severity denial of service vulnerability in openstack-neutron, published on 6 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Weakness: CWE-400
Which versions are affected by CVE-2022-3277?
7 open source packages ship an affected version, including neutron. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | All versions | 18.6.0, 19.5.0, 20.3.0 |
neutron PyPI | All versions | 18.6.0 |
neutron PyPI | All versions | 18.6.0 |
neutron PyPI | From 19.0.0.0rc1 | 19.5.0 |
neutron PyPI | From 19.0.0.0rc1 | 19.5.0 |
neutron PyPI | From 20.0.0.0rc1 | 20.3.0 |
1 more packages
neutron PyPI | From 20.0.0.0rc1 | 20.3.0 |
Linux distribution packages (21)
openstack-neutron Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-common Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-linuxbridge Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-macvtap-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-metering-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-ml2 Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-openvswitch Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-rpc-server Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
python3-neutron Red Hat:openstack:16.1::el8 | All versions | 1:15.2.1-1.20221005123225.40d217c.el8ost |
openstack-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-common Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-linuxbridge Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-macvtap-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-metering-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-ml2 Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-openvswitch Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-rpc-server Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
python3-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20221005184727.c81fb5b.el8ost |
openstack-neutron Red Hat:openstack:17.0::el9 | All versions | 1:18.4.1-0.20221128170741.5258354.el9ost |
Products include Openstack Neutron, Redhat Openstack Platform.
How do I fix CVE-2022-3277?
Upgrade neutron to a fixed version for your release line: 18.6.0, 19.5.0 or 20.3.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3277 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3277 exists.
Other vulnerabilities in openstack-neutron
- CVE-2021-38598 OpenStack Neutron vulnerable to hardware address impersonation
- CVE-2015-8914 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
- CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
- CVE-2016-5363 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
- CVE-2014-3632 Privilege escalation in n/a
Sources
Also known as DEBIAN-CVE-2022-3277, GHSA-w446-h7vg-wv3p, PYSEC-2026-855, RHSA-2022:8855, RHSA-2022:8870, RHSA-2023:0275 and 1 more.