OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-290.
Summary
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | neutron (PyPI) | before 16.4.1 | 16.4.1 | Patch available | GHSA-hvm4-mc7m-22w4 |
| — | neutron (PyPI) | 17.0.0 to before 17.1.3 | 17.1.3 | Patch available | GHSA-hvm4-mc7m-22w4 |
| — | neutron (PyPI) | — | — | No fix listed | GHSA-hvm4-mc7m-22w4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- neutron (PyPI) Vendor— Affected before 16.4.1 Fixed in 16.4.1 Patch available GHSA-hvm4-mc7m-22w4
- neutron (PyPI) Vendor— Affected 17.0.0 to before 17.1.3 Fixed in 17.1.3 Patch available GHSA-hvm4-mc7m-22w4
- neutron (PyPI) Vendor— Affected — Fixed in — No fix listed GHSA-hvm4-mc7m-22w4
Remediation
- Fix · GHSA-hvm4-mc7m-22w4 neutron (PyPI) Fixed in 16.4.1 Advisory →
- Fix · GHSA-hvm4-mc7m-22w4 neutron (PyPI) Fixed in 17.1.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
Not affected: 4 products
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38598
- 2026-10-03 Alias added: GHSA-hvm4-mc7m-22w4
- 2026-10-07 Affected versions changed · Red Hat
References
Exploit 1
Other 5
- https://github.com/openstack/neutron/commit/0a931391d8990f3e654b4bfda24ae4119c609bbf
- https://github.com/openstack/neutron/commit/cc0d28a3e2ccfad6fc2ff24d78f009cbe3992575
- https://github.com/openstack/neutron
- https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-360.yaml
- https://opendev.org/openstack/neutron/commit/fafa5dacd5057120562184a734e7345e7c0e9639
More OpenStack Neutron vulnerabilities
- TI-2022-03027 Uncontrolled resource consumption in openstack-neutron CVSS 3.1MEDIUM 6.5
- TI-2015-07327 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0CRITICAL 9.1
- TI-2014-00181 The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1… CVSS 2.0HIGH 9.0
- TI-2016-04653 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0HIGH 8.2
- TI-2016-04654 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0HIGH 8.2
- TI-2013-05386 The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does… CVSS 2.0HIGH 7.6
Sources
- CVE-2021-38598 · CVE Program
- CVE-2021-38598 · NVD
- FIRST EPSS
- GHSA-hvm4-mc7m-22w4 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-38598 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences