================================================================= OSSA-2019-004: Ageing time of 0 disables linuxbridge MAC learning =================================================================

:Date: August 29, 2019 :CVE: CVE-2019-15753

Affects ~~~~~~~ - Os-vif: >=1.15.0<1.15.2, 1.16.0

Description ~~~~~~~~~~~ James Denton with Rackspace reported a vulnerability in os-vif, the Nova/Neutron network integration library. A hard-coded MAC ageing time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding for non-local destinations which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected.

Patches ~~~~~~~ - https://review.opendev.org/678098 (Stein) - https://review.opendev.org/672834 (Train)

Credits ~~~~~~~ - James Denton from Rackspace (CVE-2019-15753)

References ~~~~~~~~~~ - https://launchpad.net/bugs/1837252 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15753