CVE-2021-20267

Vulnerability

A flaw exists in OpenStack Neutron's default Open vSwitch firewall rules (Open vSwitch driver only). By sending carefully crafted packets, an attacker in control of a server instance connected to the virtual switch can impersonate IPv6 addresses of other systems on the network. Affected versions include openstack-neutron before 15.3.3, before 16.3.1, and before 17.1.1 [1][4].

Exploitation

An attacker must have control of a server instance connected to a virtual switch using the Open vSwitch driver. No special network position is required beyond being on the same virtual switch. By crafting specific packets, the attacker can spoof IPv6 addresses, effectively bypassing the anti-spoofing rules intended to prevent such behavior [1][4].

Impact

Successful exploitation results in denial of service or, in some cases, interception of traffic intended for other destinations. The attacker can impersonate other systems on the network, leading to potential information disclosure or disruption [1].

Mitigation

Fixed versions: openstack-neutron 15.3.3, 16.3.1, and 17.1.1 (released around May-June 2021) [1]. Red Hat noted that no mitigation was available at the time of disclosure for affected products, and the fix was included in later packages (e.g., openstack-neutron-12.1.1-44.el7ost for OSP-13) [4].