[OSSA 2015-001] L3 agent DoS vulnerability (CVE-2014-8153)

[Thierry Carrez]

Reported by Ihar Hrachyshka via email:

we've found a bug [1] in Openstack Neutron Juno (2014.2) release that
(it seems) may be utilized to make Neutron L3 agent non-functional
during the following scenario (initially reported in downstream as [2]):

- a tenant (user) creates 8 routers;
- for each router, a tenant assigns a ipv6 non-provider subnet.

=> L3 agent limits the number of threads that process updates to
router state to 8 [3]. Since the bug makes the thread lock if the
release is used with radvd 2.0+, it's enough to have those 8 failing
routers to completely block any kind of router updates processing for
all tenants.

The vulnerability is limited to setups that run on top of radvd 2.0+.
There are few distributions that currently ship radvd 2.0+,
so the scope of the vulnerability is not very wide (in Red Hat world,
it's mostly Fedora Rawhide).

The bug in question is public, though I haven't raised its potential
security status in any public or private communications before.

[1]: https://launchpad.net/bugs/1398779
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=1169408
[3]: https://github.com/openstack/neutron/blob/master/neutron/agent/l3_agent.py#L1831

[Salvatore Orlando (salvatore-orlando)]

The security implication seems appropriate. I have not reproduced it, but looking at the code it is pretty obvious what will happen with the different behaviour of radvd 2

[Thierry Carrez (ttx)]

Confirming based on Salvatore's analysis.
Would Icehouse also be affected ?

[Thierry Carrez (ttx)]

master fix in progress at https://review.openstack.org/138688

[Ihar Hrachyshka (ihar-hrachyshka)]

In Icehouse, we didn't have radvd support, so there should be no issue.

[Ihar Hrachyshka (ihar-hrachyshka)]

Fix is merged in Kilo, and backport for Juno is requested: https://review.openstack.org/141575

[Tristan Cacqueray (tristan-cacqueray)]

Here is impact description draft #1

Title: L3 agent denial of service with radvd 2.0+
Reporter: Ihar Hrachyshka (RH)
Products: Neutron
Versions: 2014.2 version up to 2014.2.1

Description:
Ihar Hrachyshka from Red Hat reported a vulnerability in Neutron. By creating 8 routers and assigning each of them a non-provider ipv6 subnet, a malicious user may blocks router update processing for all tenants. Only Neutron setups running with radvd 2.0+ are affected.

[Grant Murphy (gmurphy)]

+1 impact description

[Thierry Carrez (ttx)]

blocks -> block
maybe add "for all tenants, potentially resulting in a Denial of Service." ?

[Tristan Cacqueray (tristan-cacqueray)]

Thanks for the reviews, here is impact description draft #2:

Title: L3 agent denial of service with radvd 2.0+
Reporter: Ihar Hrachyshka (RH)
Products: Neutron
Versions: 2014.2 version up to 2014.2.1

Description:
Ihar Hrachyshka from Red Hat reported a vulnerability in Neutron. By creating 8 routers and assigning each of them a non-provider ipv6 subnet, a malicious user may block router update processing for all tenants, potentially resulting in a Denial of Service. Only Neutron setups running with radvd 2.0+ are affected.

[Thierry Carrez (ttx)]

Impact desc +1

[Ihar Hrachyshka (ihar-hrachyshka)]

FYI fix is merged in all affected branches (Juno+).

[Tristan Cacqueray (tristan-cacqueray)]

Proposed public disclosure date/time:
2015-01-08, 1500UTC

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/145810
Committed: https://git.openstack.org/cgit/openstack/ossa/commit/?id=82756ab36e8abc2c25ef47c8ab614a3158e3b9f2
Submitter: Jenkins
Branch: master

commit 82756ab36e8abc2c25ef47c8ab614a3158e3b9f2
Author: Tristan Cacqueray <email address hidden>
Date: Thu Jan 15 20:50:58 2015 +0000

    Adds OSSA-2015-001

    Related-Bug: #1399172
    Change-Id: I135c9278bc97cd9d731675ac8d155f9a3b1a2f33