PT-2019-14372 · Openstack · Openstack Os-Vif

James Denton · Published 2019-08-28 · Updated 2022-05-24 · CVE-2019-15753

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenStack os-vif versions 1.15.x through 1.15.1 OpenStack os-vif version 1.16.0

Description The issue affects deployments using the linuxbridge backend, where a hard-coded MAC aging time of 0 disables MAC learning. This forces obligatory Ethernet flooding of non-local destinations, impeding network performance and potentially allowing users to view the content of packets for instances belonging to other tenants on the same network. The problem occurs in the PyRoute2.add() function, located in the internal/command/ip/linux/impl pyroute2.py file.

Recommendations For OpenStack os-vif versions 1.15.x through 1.15.1, update to version 1.15.2 or later to resolve the issue. For OpenStack os-vif version 1.16.0, consider disabling the linuxbridge backend until a patch is available, or restrict access to the affected network to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2019-15753

GHSA-MCPW-CP35-P3H8

Affected Products

Openstack Os-Vif

References · 16

• https://review.opendev.org/678098 · Patch
• https://security.openstack.org/ossa/OSSA-2019-004.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mcpw-cp35-p3h8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15753 · Vendor Advisory
• https://review.opendev.org/672834 · Patch
• http://openwall.com/lists/oss-security/2019/08/29/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-15753 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15753 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15753 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15753 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15753 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15753 · Vendor Advisory
• https://github.com/openstack/os-vif · Note
• https://github.com/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7 · Note
• https://github.com/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aef · Note