[OSSA-2021-005] Neutron: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085)

Jeremy Stanley fungi at yuggoth.org
Tue Aug 31 15:00:24 UTC 2021

OSSA-2021-005: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts

:Date: August 31, 2021
:CVE: CVE-2021-40085

- Neutron: <16.4.1, >=17.0.0 <17.2.1, >=18.0.0 <18.1.1

Pavel Toporkov reported a vulnerability in Neutron. By supplying a
specially crafted extra_dhcp_opts value, an authenticated user may add
arbitrary configuration to the dnsmasq process in order to crash the
service, change parameters for other tenants sharing the same
interface, or otherwise alter that daemon's behavior. This
vulnerability may also be used to trigger a configuration parsing
buffer overflow in versions of dnsmasq prior to 2.81, which could lead
to remote code execution. All Neutron deployments are affected.

- https://review.opendev.org/806750 (Ussuri)
- https://review.opendev.org/806749 (Victoria)
- https://review.opendev.org/806748 (Wallaby)
- https://review.opendev.org/806746 (Xena)

- Pavel Toporkov (CVE-2021-40085)

- https://launchpad.net/bugs/1939733
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40085

Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack-discuss/attachments/20210831/d518c7d2/attachment.sig>

More information about the openstack-discuss mailing list