#VU16341 Improper input validation in openstack-neutron - CVE-2018-14635

Vulnerability identifier: #VU16341

Vulnerability risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-14635

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
openstack-neutron
Client/Desktop applications / Other client software

Vendor: Openstack

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to improper IP address validation by the affected software when the Linux bridge ml2 driver is used.. A remote attacker can add a router interface to a network's subnet that includes an IP address outside the subnet's allocation pool and cause a DoS condition if the added IP address is already assigned to another system.

Mitigation
The vulnerability has been fixed in the version 13.0.0.0b2, 12.0.3, 11.0.5.

Vulnerable software versions

openstack-neutron: 9.0.0 - 9.4.1, 10.0.0 - 10.0.7, 11.0.0 - 11.0.4, 12.0.0 - 12.0.2

---

External links
https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.