Lucene search

GitHub Advisory DatabaseGHSA-HVM4-MC7M-22W4

HistoryMay 24, 2022 - 7:11 p.m.

OpenStack Neutron vulnerable to hardware address impersonation

2022-05-2419:11:58

CWE-863

GitHub Advisory Database

github.com

openstack neutron

hardware address impersonation

linuxbridge driver

ebtables-nft

netfilter-based platform

denial of service

interception of traffic

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.