CVE-2017-5936

Advisory

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.


MLIST:[oss-security] 20170208 Re: CVE Request: Nova-LXD incorrectly applied Neutron security group rules: http://www.openwall.com/lists/oss-security/2017/02/09/3
CONFIRM:https://bugs.launchpad.net/nova-lxd/+bug/1656847: https://bugs.launchpad.net/nova-lxd/+bug/1656847
CONFIRM:https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2: https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2
UBUNTU:USN-3195-1: http://www.ubuntu.com/usn/USN-3195-1
BID:96182: http://www.securityfocus.com/bid/96182

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5936
• https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2
• https://bugs.launchpad.net/nova-lxd/+bug/1656847
• http://www.ubuntu.com/usn/USN-3195-1
• http://www.securityfocus.com/bid/96182
• http://www.openwall.com/lists/oss-security/2017/02/09/3