Critical severity · published Aug 28, 2019
CVE-2019-15753
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local…
9.1
CVSS
2.6%
EPSS
No
On KEV
Description
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Os-vif · Openstack
1.15.0 before 1.15.2; 1.16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15753
Mailing List
http://www.openwall.com/lists/oss-security/2019/08/29/2
Issue Tracking
https://launchpad.net/bugs/1837252
Patch
https://review.opendev.org/672834
Patch
https://review.opendev.org/678098
Patch
https://security.openstack.org/ossa/OSSA-2019-004.html