CVE-2017-7543

Vulnerability

A race-condition flaw exists in openstack-neutron where, during a minor overcloud update, the kernel parameters net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables are reset to 0. This disables iptables filtering for bridged traffic, effectively disabling neutron security groups. The vulnerability affects openstack-neutron versions before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1 [1][2].

Exploitation

An attacker does not require authentication or special privileges; the race is only triggered by the update process itself. When a system administrator performs a minor overcloud update on affected OpenStack deployments, the race condition may cause the bridge-nf-call sysctls to be reset. During the window between the update and the restoration of these settings (or if they are not restored), an attacker on the same network segment can access tenant virtual machines (VMs) and network resources that would normally be protected by security group rules [1][2]. No user interaction from the victim is needed beyond the administrator applying the update.

Impact

Successful exploitation allows an attacker to bypass neutron security group filtering, resulting in unauthorized network access to tenant VMs and resources. This can lead to information disclosure, potential data modification, or further lateral movement within the cloud environment. The compromise occurs at the network isolation layer, effectively nullifying the security group protections intended by the OpenStack deployment [1][2][3][4].

Mitigation

Red Hat released security updates for Red Hat Enterprise Linux OpenStack Platform versions 6.0 (Juno) and 7.0 (Kilo) on 2017-08-08 under RHSA-2017:2452 and RHSA-2017:2450, respectively [3][4]. The fixed versions are: openstack-neutron-2014.2.3-42.el7ost for Juno and openstack-neutron-2015.1.4-16.1.el7ost for Kilo [3][4]. Administrators should apply these updates and ensure that the net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables sysctls are set to 1 and persisted after updates. No workarounds other than patching are documented. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.