CVE-2018-14636

Vulnerability

CVE-2018-14636 affects OpenStack Neutron versions before 13.0.0.0b2, 12.0.3, and 11.0.5. During live migration, an instance's port is temporarily connected to the Open vSwitch integration bridge without VLAN filtering, allowing the migrated instance to see traffic from other tenants on the same hypervisor. If the port is set administratively down before migration and kept down afterward, this exposure becomes permanent [1][2].

Exploitation

An attacker requires an OpenStack administrator (or automated process) to schedule a live migration for an instance under the attacker's control on a compute node using Open vSwitch self-service networks. The attacker's instance is initially created with a trunk port; during migration the port remains untagged, and if the port is kept administratively down, it stays in trunk mode indefinitely, enabling traffic inspection from other tenants [1][3].

Impact

A successful exploit allows the attacker's instance to receive traffic from and send traffic to other private networks on the same compute node, violating network isolation. This can lead to disclosure of sensitive data from co-tenant instances and unauthorized network access [1][2].

Mitigation

Red Hat and upstream OpenStack fixed this issue in Neutron versions 13.0.0.0b2, 12.0.3, and 11.0.5; the vulnerability is also addressed in OpenStack Platform versions 14.0.4, 13.0.9, and later [2][3]. Operators should upgrade Neutron to these patched versions. A workaround is to ensure ports are not left administratively down after live migration, and to monitor for unauthorized traffic [1].