Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)

Vulnerability

Description CVE-2023-3637 is an uncontrolled resource consumption flaw in OpenStack Networking (neutron). The root cause is that when a remote authenticated user queries a list of security groups for an invalid project, the system creates resources that are not constrained by the user's quota [1][2][4]. This effectively bypasses the intended limits on resource usage, allowing a single, authenticated user to exhaust system resources.

Attack

Vector An authenticated user with network access to the OpenStack API can exploit this by sending a significant number of requests for a list of security groups tied to a non-existent (invalid) project. The vulnerability does not require any special privileges beyond standard user authentication. The attack is performed remotely over the network [1][2].

Impact

Successful exploitation leads to uncontrolled resource consumption, which can result in a denial of service (DoS) condition. The user's quota is not enforced, so a modest number of requests can exhaust backend resources, potentially affecting the availability of the neutron service for legitimate users [2][4]. Red Hat has rated this as a Moderate severity issue [3].

Mitigation

Red Hat released an advisory RHSA-2023:4283 on 2023-07-26 to address this flaw in Red Hat OpenStack Platform 16.2 (Train) [3]. The update includes a fix that properly constrains resource creation by enforcing user quotas. Organizations running affected versions should apply the security update to prevent exploitation.