Resource exhaustion in openstack-neutron - CVE-2021-40797

Vulnerability identifier: #VU59320

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-40797

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing API calls to nonexistent controllers. A remote authenticated user can trigger resource exhaustion by sending multiple API calls and perform a denial of service (DoS) attack.

openstack-neutron
PowerVC
Red Hat OpenStack
Red Hat OpenStack for IBM Power
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Ubuntu
openstack-neutron (Red Hat package)
python-neutron
openstack-neutron
openstack-neutron-dhcp-agent
openstack-neutron-doc
openstack-neutron-ha-tool
openstack-neutron-l3-agent
openstack-neutron-linuxbridge-agent
openstack-neutron-macvtap-agent
openstack-neutron-metadata-agent
openstack-neutron-metering-agent
openstack-neutron-openvswitch-agent
openstack-neutron-server
python-neutron (Ubuntu package)
python3-neutron (Ubuntu package)

Install updates from vendor's website.

openstack-neutron - addressed in versions 16.4.1, 17.2.1, 18.1.1
openstack-neutron (Red Hat package) - addressed in versions 15.2.1-1.20220112133420.el8ost, 15.3.5-2.20220113150031.el8ost
python-neutron - update to 11.0.9~dev69-3.43.1
openstack-neutron - update to 11.0.9~dev69-3.43.1
openstack-neutron-dhcp-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-doc - update to 11.0.9~dev69-3.43.1
openstack-neutron-ha-tool - update to 11.0.9~dev69-3.43.1
openstack-neutron-l3-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-linuxbridge-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-macvtap-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-metadata-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-metering-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-openvswitch-agent - update to 11.0.9~dev69-3.43.1
openstack-neutron-server - update to 11.0.9~dev69-3.43.1
python-neutron (Ubuntu package) - update to 2:12.1.1-0ubuntu8.1
python3-neutron (Ubuntu package) - addressed in versions 2:16.4.2-0ubuntu6.2, 2:20.3.0-0ubuntu1.1

• https://launchpad.net/bugs/1942179
• https://security.openstack.org/ossa/OSSA-2021-006.html
• http://www.openwall.com/lists/oss-security/2021/09/09/2

• Denial of service in OpenStack Neutron
• Denial of service in IBM PowerVC
• Red Hat OpenStack Platform 16.1 update for openstack-neutron
• Red Hat OpenStack Platform 16.2 update for openstack-neutron
• SUSE update for openstack-neutron
• Ubuntu update for neutron