VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 12, 2017· Updated May 13, 2026

CVE-2017-5936

CVE-2017-5936

Description

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nova-lxdPyPI
< 13.1.113.1.1

Affected products

2

Patches

1
1b76cefb9208

Ensure LXD veth host device is named correctly

https://github.com/openstack/nova-lxdJames PageJan 31, 2017via ghsa
commit
2 files changed · +6 −3
  • nova_lxd/nova/virt/lxd/config.py+6 −2 modified
    @@ -224,11 +224,15 @@ def create_network(self, instance_name, instance, network_info):
 
             for vifaddr in network_info:
                 cfg = self.vif_driver.get_config(instance, vifaddr)
-                network_devices[str(cfg['bridge'])] = \
+                key = str(cfg['bridge'])
+                network_devices[key] = \
                     {'nictype': 'bridged',
                      'hwaddr': str(cfg['mac_address']),
-                     'parent': str(cfg['bridge']),
+                     'parent': key,
                      'type': 'nic'}
+                host_device = self.vif_driver.get_vif_devname(vifaddr)
+                if host_device:
+                    network_devices[key]['host_name'] = host_device
                 return network_devices
         except Exception as ex:
             with excutils.save_and_reraise_exception():
  • setup.cfg+0 −1 modified
    @@ -3,7 +3,6 @@ name = nova-lxd
 summary = native lxd driver for openstack
 description-file =
     README.md
-version = 13.2.0
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
 home-page = http://www.openstack.org/

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.