RHSA-2017:2648 - Security Advisory

Topic

An update for openvswitch is now available for Red Hat OpenStack Platform 10.0 (Newton).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

• An unsigned int wrap around leading to a buffer over-read was found when parsing OFPT_QUEUE_GET_CONFIG_REPLY messages in Open vSwitch (OvS). An attacker could use this flaw to cause a remote DoS. (CVE-2017-9214)
• In Open vSwitch (OvS), while parsing an OpenFlow role status message there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch. (CVE-2017-9263)
• A buffer over-read was found in the Open vSwitch (OvS) firewall implementation. This flaw can be triggered by parsing a specially crafted TCP, UDP, or IPv6 packet. A remote attack could use this flaw to cause a Denial of Service (DoS). (CVE-2017-9264)
• A buffer over-read flaw was found in Open vSwitch (OvS) while parsing the group mod OpenFlow messages sent from the controller. An attacker could use this flaw to cause a Denial of Service (DoS). (CVE-2017-9265)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 10 x86_64

Fixes

• BZ - 1431490 - openvswitch: /var/log/openvswitch is world readable
• BZ - 1436610 - [OVS] ofproto-dpif-xlate: Fix duplicate multicast packets
• BZ - 1456795 - CVE-2017-9214 openvswitch: Integer underflow in the ofputil_pull_queue_get_config_reply10 function
• BZ - 1457327 - CVE-2017-9263 openvswitch: Invalid processing of a malicious OpenFlow role status message
• BZ - 1457329 - CVE-2017-9264 openvswitch: Buffer over-read while parsing malformed TCP, UDP and IPv6 packets
• BZ - 1457335 - CVE-2017-9265 openvswitch: Buffer over-read while parsing the group mod OpenFlow message
• BZ - 1463732 - Update OVS 2.6.1 to fix multicast
• BZ - 1468334 - neutron-openvswitch-agent crashes after SIGTERM is received and openvswitch/agent are not restarted
• BZ - 1468631 - openvswitch segfaults when changing port VIF MTU and there's traffic flowing
• BZ - 1468751 - Explicit restart of openvswitch required for dpdk0 association
• BZ - 1472334 - [OVS] mcast-snooping: Avoid segfault for vswitchd
• BZ - 1472335 - [OVS] mcast-snooping: Flush ports mdb when VLAN configuration changed.
• BZ - 1473735 - ovs-vswitchd crashes with SIGSEGV randomly when adding/removing interfaces

CVEs

• CVE-2017-9214
• CVE-2017-9263
• CVE-2017-9264
• CVE-2017-9265

References

• https://access.redhat.com/security/updates/classification/#moderate