CVE-2017-7543
openstack-neutron: iptables not active after update
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
Se ha descubierto una condición de carrera en openstack-neutron en versiones anteriores a la 7.2.0-12.1, 8.x anteriores a la 8.3.0-11.1, 9.x anteriores a la 9.3.1-2.1 y 10.x anteriores a la 10.0.2-1.1, cuando, siguiendo a una actualización overcloud menor, los grupos de seguridad neutron estaban deshabilitados. De manera específica, lo siguiente se ha reiniciado a 0: net.bridge.bridge-nf-call-ip6tables y net.bridge.bridge-nf-call-iptables. La carrera solo se desencadenó con una actualización, en cuyo momento un atacante podía acceder a las máquinas virtuales de los inquilinos y a los recursos de red expuestos.
A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-05 CVE Reserved
- 2017-08-08 CVE Published
- 2024-05-10 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/100237 | Third Party Advisory | |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543 | Issue Tracking |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2017:2447 | 2023-02-12 | |
https://access.redhat.com/errata/RHSA-2017:2448 | 2023-02-12 | |
https://access.redhat.com/errata/RHSA-2017:2449 | 2023-02-12 | |
https://access.redhat.com/errata/RHSA-2017:2450 | 2023-02-12 | |
https://access.redhat.com/errata/RHSA-2017:2451 | 2023-02-12 | |
https://access.redhat.com/errata/RHSA-2017:2452 | 2023-02-12 | |
https://access.redhat.com/security/cve/CVE-2017-7543 | 2017-08-08 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1473792 | 2017-08-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 6.0 Search vendor "Redhat" for product "Openstack" and version "6.0" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Safe
|
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 7.0 Search vendor "Redhat" for product "Openstack" and version "7.0" | - |
Affected
| in | Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0" | - |
Safe
|
Openstack Search vendor "Openstack" | Neutron Search vendor "Openstack" for product "Neutron" | >= 7.0.0 < 7.2.0-12.1 Search vendor "Openstack" for product "Neutron" and version " >= 7.0.0 < 7.2.0-12.1" | - |
Affected
| ||||||
Openstack Search vendor "Openstack" | Neutron Search vendor "Openstack" for product "Neutron" | >= 8.0.0 < 8.3.0-11.1 Search vendor "Openstack" for product "Neutron" and version " >= 8.0.0 < 8.3.0-11.1" | - |
Affected
| ||||||
Openstack Search vendor "Openstack" | Neutron Search vendor "Openstack" for product "Neutron" | >= 9.0.0 < 9.3.1-2.1 Search vendor "Openstack" for product "Neutron" and version " >= 9.0.0 < 9.3.1-2.1" | - |
Affected
| ||||||
Openstack Search vendor "Openstack" | Neutron Search vendor "Openstack" for product "Neutron" | >= 10.0.0 < 10.0.2-1.1 Search vendor "Openstack" for product "Neutron" and version " >= 10.0.0 < 10.0.2-1.1" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 8 Search vendor "Redhat" for product "Openstack" and version "8" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 9 Search vendor "Redhat" for product "Openstack" and version "9" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 10 Search vendor "Redhat" for product "Openstack" and version "10" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 11 Search vendor "Redhat" for product "Openstack" and version "11" | - |
Affected
|