CVE-2016-2074: MPLS buffer overflow vulnerabilities in Open vSwitch

[Dmitry Teselkin]

Multiple versions of Open vSwitch are vulnerable to remote buffer
overflow attacks, in which crafted MPLS packets could overflow the
buffer reserved for MPLS labels in an OVS internal data structure.
The MPLS packets that trigger the vulnerability and the potential for
exploitation vary depending on version:

    - Open vSwitch 2.1.x and earlier are not vulnerable.

    - In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
      exploited for arbitrary remote code execution.

    - In Open vSwitch 2.4.x, the MPLS buffer overflow does not
      obviously lead to a remote code execution exploit, but testing
      shows that it can allow a remote denial of service. See the
      mitigation section for details.

    - Open vSwitch 2.5.x is not vulnerable.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2016-2074 to this issue.

http://seclists.org/oss-sec/2016/q1/706

[Bug Checker Bot (bug-checker)]

(This check performed automatically)
Please, make sure that bug description contains the following sections filled in with the appropriate data related to the bug you are describing:

actual result

expected result

steps to reproduce

For more detailed information on the contents of each of the listed sections see https://wiki.openstack.org/wiki/Fuel/How_to_contribute#Here_is_how_you_file_a_bug

[Alexey Stupnikov (astupnikov)]

Dmitry, please consider the following objections to this bug. I don't see and opportunity for an attacker to use this vulnerability for the following reasons:
  - MPLS PDUs are not transmitted over traditional IP networks, so it is impossible to deliver them to cloud's OVS switches from external networks;
  - we have a SG implemented on closest-to VMs linux bridges, so it is impossible to inject MPLS traffic from VMs.

Maybe we have to doublecheck attack vectors for this issue?

[Vitaly Sedelnik (vsedelnik)]

Setting to Incomplete, Dmitry T - please provide specific scenario how MOS cloud is affected by the issue.

[Adam Heczko (aheczko-mirantis)]

IMO one could disable Neutron port security mechanism and inject MPLS packets.
https://specs.openstack.org/openstack/neutron-specs/specs/kilo/ml2-ovs-portsecurity.html
Of course MOS is vulnerable, the vulnerability is there but the attack vector is limited.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: master
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19317

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: master
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19343

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: master
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19352

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19317
Submitter: Pkgs Jenkins <email address hidden>
Branch: master

Commit: 23b67a5c2233c2a8103ad874f1931dbe38188935
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 12:02:13 2016

Fix for CVE-2016-2074. MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I4c89760425bd12fb2c39c3e06c77eff117fd8ca8
Closes-Bug: #1563753

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19343
Submitter: Pkgs Jenkins <email address hidden>
Branch: master

Commit: 30470f49fea68ac3986304bf9c8ddec67409faf6
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 11:59:04 2016

CVE-2016-2074 fix: MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I3599e76208ecd7c356165601d1cfe1d3bffa0b09
Closes-Bug: #1563753

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 9.0
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19401

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 9.0
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19402

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19352
Submitter: Pkgs Jenkins <email address hidden>
Branch: master

Commit: 1e228a7f2b607b62bc7e9c0d8b01a440bece7d46
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 11:58:04 2016

CVE-2016-2074 fix: MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I0e68a72829b48157c6bdb84e8ce91e8baa007243
Closes-Bug: #1563753

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 9.0
Change author: Albert Syriy <email address hidden>
Review: https://review.fuel-infra.org/19404

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19402
Submitter: Pkgs Jenkins <email address hidden>
Branch: 9.0

Commit: cba606998e4fffd18a9a6dd8632274451517df76
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 16:52:46 2016

CVE-2016-2074 fix: MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I3599e76208ecd7c356165601d1cfe1d3bffa0b09
Closes-Bug: #1563753
(cherry picked from commit 30470f49fea68ac3986304bf9c8ddec67409faf6)

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19404
Submitter: Pkgs Jenkins <email address hidden>
Branch: 9.0

Commit: cd316a7bb66d974de5941c5644380f5d741bac18
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 17:08:15 2016

CVE-2016-2074 fix: MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I0e68a72829b48157c6bdb84e8ce91e8baa007243
Closes-Bug: #1563753
(cherry picked from commit 1e228a7f2b607b62bc7e9c0d8b01a440bece7d46)

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/19401
Submitter: Pkgs Jenkins <email address hidden>
Branch: 9.0

Commit: 5efb645987c6a2d258606fe476ebeaf4e46503e2
Author: Albert Syriy <email address hidden>
Date: Thu Apr 7 16:52:20 2016

Fix for CVE-2016-2074. MPLS buffer overflow vulnerabilities in Open vSwitch.

Change-Id: I4c89760425bd12fb2c39c3e06c77eff117fd8ca8
Closes-Bug: #1563753
(cherry picked from commit 23b67a5c2233c2a8103ad874f1931dbe38188935)

[Albert Syriy (asyriy)]

Fix has been comited into Ubuntu/Centos openvswitch packages.

[Alexander Gubanov (ogubanov)]

I've verified it (MOS 9.0 build 201) as mentioned at http://seclists.org/oss-sec/2016/q1/706 - Open vSwitch is not vulnerable.
Proof: http://pastebin.com/jWNXWCMq

Moved to "Fix Release".

[Denis Meltsaykin (dmeltsaykin)]

Closing as Won't Fix as this is a medium importance non-customer-found bug.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Dmitry Teselkin <email address hidden> on branch: 9.0
Review: https://review.fuel-infra.org/25435
Reason: Merged in https://review.fuel-infra.org/#/q/topic:group/prod-7907