PT-2021-22795 · Openstack+3 · Openstack Neutron+3

Pavel Toporkov · Published 2021-08-31 · Updated 2024-08-07 · CVE-2021-40085

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 16.4.1 OpenStack Neutron versions 17.x prior to 17.2.1 OpenStack Neutron versions 18.x prior to 18.1.1

Description An issue was discovered in OpenStack Neutron. Authenticated attackers can reconfigure dnsmasq via a crafted extra dhcp opts value.

Recommendations For OpenStack Neutron versions prior to 16.4.1, update to version 16.4.1 or later. For OpenStack Neutron versions 17.x prior to 17.2.1, update to version 17.2.1 or later. For OpenStack Neutron versions 18.x prior to 18.1.1, update to version 18.1.1 or later. As a temporary workaround, consider restricting the use of the extra dhcp opts value to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

ALT-PU-2024-10658

ALT-PU-2024-1575

CVE-2021-40085

DLA-2781-1

DLA-3027-1

DSA-4983-1

GHSA-FH73-GJVG-349C

PYSEC-2021-361

RHSA-2021:3481

RHSA-2021:3488

RHSA-2021:3502

RHSA-2021:3503

SUSE-SU-2022:1729-1

SUSE-SU-2022:1884-1

USN-6067-1

Affected Products

Alt Linux

Linuxmint

Openstack Neutron

Ubuntu

References · 71

• 🔥 https://launchpad.net/bugs/1939733 · Exploit
• http://openwall.com/lists/oss-security/2021/08/31/2 · Patch
• https://osv.dev/vulnerability/DLA-2781-1 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2021-005.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40085 · Vendor Advisory
• https://debian.org/security/2021/dsa-4983 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3277 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40797 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh73-gjvg-349c · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-361 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40085 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40085 · Security Note
• https://osv.dev/vulnerability/DSA-4983-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1884-1 · Vendor Advisory