Dmitry, please consider the following objections to this bug. I don't see and opportunity for an attacker to use this vulnerability for the following reasons:
- MPLS PDUs are not transmitted over traditional IP networks, so it is impossible to deliver them to cloud's OVS switches from external networks;
- we have a SG implemented on closest-to VMs linux bridges, so it is impossible to inject MPLS traffic from VMs.
Maybe we have to doublecheck attack vectors for this issue?
Dmitry, please consider the following objections to this bug. I don't see and opportunity for an attacker to use this vulnerability for the following reasons:
- MPLS PDUs are not transmitted over traditional IP networks, so it is impossible to deliver them to cloud's OVS switches from external networks;
- we have a SG implemented on closest-to VMs linux bridges, so it is impossible to inject MPLS traffic from VMs.
Maybe we have to doublecheck attack vectors for this issue?