CVE-2021-38598: Impersonation Vulnerability in OpenStack Neutron
Summary
CVE-2021-38598: OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. Affects neutron across 3 version ranges.
< 16.4.1
>= 17.0.0, < 17.1.3
>= 18.0.0, < 18.1.0
Fixed in 16.4.1, 17.1.3 or 18.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- neutron · Debian:11
The same CVE-2021-38598 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Neutron is a networking service that provides connectivity between different components and services in an OpenStack cloud environment. It enables the creation and management of virtual networks, routers, and security groups. Neutron uses various drivers to implement network functionality, including the linuxbridge driver with ebtables-nft on Netfilter-based platforms.
Vulnerability Detail
The vulnerability (CVE-2021-38598) in OpenStack Neutron allows for hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. This means that an attacker who has control over a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network. This can lead to denial of service or interception of traffic intended for other destinations. The vulnerability affects Neutron versions before 16.4.1, 17.x before 17.1.3, and 18.0.0.
How To Fix
Latest published version: 29.0.0 as of 22 Oct 2026
pip install --upgrade "neutron==29.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 16.4.116.4.1pip install --upgrade "neutron==16.4.1" -
>= 17.0.0, < 17.1.317.1.3pip install --upgrade "neutron==17.1.3" -
>= 18.0.0, < 18.1.018.1.0pip install --upgrade "neutron==18.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fixed versions of Neutron as mentioned in the 'how_to_fix' section.
Conclusion
The impersonation vulnerability in OpenStack Neutron can have serious security implications, allowing attackers to impersonate hardware addresses and potentially intercept network traffic. It is crucial to upgrade to the fixed versions of Neutron to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for neutron →
FAQ
OpenStack Neutron is a networking service in OpenStack that provides connectivity between different components and services in a cloud environment.
The linuxbridge driver with ebtables-nft is a networking driver used by Neutron on Netfilter-based platforms to implement network functionality.
The vulnerability in Neutron allows an attacker to impersonate the hardware addresses of other systems on the network by sending carefully crafted packets.
The vulnerability can result in denial of service or interception of traffic intended for other destinations.
The vulnerability affects Neutron versions before 16.4.1, 17.x before 17.1.3, and 18.0.0.
References
Related vulnerabilities
Recent vulnerabilities recorded for neutron.
