Hardware Address Impersonation Vulnerability in OpenStack Neutron
Summary
CVE-2021-38598: OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. Affects neutron across 2 version ranges.
< 2:17.2.1-0+deb11u1
< 6a761dc42da99625bb18b4aabf4e2b340396c78c
Fixed in 2:17.2.1-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Neutron is a core component of the OpenStack cloud computing platform, responsible for providing networking as a service between interface devices managed by other OpenStack services. It enables users to create and manage networks, subnets, and routers, and supports various networking technologies. The vulnerability in question affects versions of Neutron prior to 16.4.1, 17.x before 17.1.3, and 18.0.0, specifically when using the linuxbridge driver with ebtables-nft on Netfilter-based platforms.
Vulnerability Detail
The vulnerability, identified as CVE-2021-38598, allows for hardware address impersonation. An attacker controlling a server instance connected to the virtual switch can send specially crafted packets to impersonate the hardware addresses of other systems on the network. This can lead to denial of service or potentially allow the interception of traffic intended for other destinations. The issue arises from the way the linuxbridge driver handles network traffic, making it susceptible to exploitation under specific conditions.
How To Fix
Minimum fixed version
2:17.2.1-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade neutronTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement network segmentation to limit the exposure of vulnerable instances and restrict access to the virtual switch. Additionally, monitoring network traffic for unusual patterns may help mitigate the risk until a proper fix is applied.
Conclusion
CVE-2021-38598 represents a significant security risk for users of OpenStack Neutron, allowing for hardware address impersonation that can lead to denial of service and traffic interception. It is crucial for affected users to upgrade to the patched versions of Neutron to mitigate this vulnerability.
See every vulnerability recorded for neutron →
FAQ
CVE-2021-38598 is a vulnerability in OpenStack Neutron that allows hardware address impersonation, potentially leading to denial of service or traffic interception.
The vulnerability affects OpenStack Neutron versions before 16.4.1, 17.x before 17.1.3, and 18.0.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-38598 is 9.1, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing network segmentation and monitoring traffic for unusual activity as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for neutron.
