CVE-2014-3555

What it actually does

Remote authenticated users can submit a large number of allowed address pairs on a port, triggering excessive resource consumption during firewall rule processing that leads to a service crash or prolonged update delays.

Why it matters to the business

Attackers with valid credentials can disrupt network services in OpenStack deployments, causing outages that affect virtual machine connectivity and require manual intervention to restore operations.

How an attack unfolds

An authenticated user repeatedly creates or updates ports with an excessive number of allowed address pairs; the Neutron server processes each pair into firewall rules, exhausting CPU or memory and either crashing the service or delaying all subsequent rule updates.

How to fix it

Upgrade OpenStack Neutron to 2013.2.4 or later, 2014.1.2 or later, or Juno-2 or later. Enforce API rate limits on port updates and monitor for abnormal address-pair counts until patches are applied.

How to confirm the fix worked

Confirm the installed Neutron package version meets or exceeds the fixed releases listed above; test by attempting to create a port with a high number of address pairs and verify the request is rejected or processed without service impact.

Typical attack path

1. Obtain valid credentials for an OpenStack tenant
2. Use Neutron API to create or update a port
3. Attach a large volume of allowed address pairs to the port
4. Repeat the operation to amplify resource exhaustion
5. Observe service degradation or crash in Neutron agents

How to detect it

Inspect Neutron server and agent logs for repeated port-update or security-group-update entries containing unusually large allowed_address_pairs lists; correlate with API request volume from individual tenants.

What your security team should do

• Prioritize upgrade of Neutron to a fixed release in all production environments
• Implement tenant-level quotas and API throttling for port modifications
• Review logs for repeated port-update operations with high address-pair counts
• Disable unnecessary allowed-address-pair features if not required