CVE-2017-5936

What it actually does

The flaw applies Neutron security group rules to incorrect veth pair interface names for LXD instances, causing the intended packet filtering to be bypassed on actual instance traffic paths.

Why it matters to the business

Attackers can reach virtual instances across the network without being stopped by configured security policies, increasing risk of unauthorized access to cloud workloads and data.

How an attack unfolds

An attacker identifies an LXD instance whose security groups should block specific traffic, then sends packets that violate those rules; because rules were applied to the wrong veth name, the traffic reaches the instance unimpeded.

How to fix it

Upgrade Nova-LXD to version 13.1.1 or later (or apply commit 1b76cefb92081efa1e88cd8f330253f857028bd2) so that security group rules are applied to the correct veth pairs.

How to confirm the fix worked

Confirm Nova-LXD version is 13.1.1 or newer; test by sending traffic that should be blocked by security groups and verify it is now dropped at the correct interfaces.

Typical attack path

1. Locate an OpenStack LXD instance subject to Neutron security groups
2. Determine traffic types blocked by the groups
3. Send violating network packets directly to the instance
4. Confirm delivery of previously restricted traffic

How to detect it

Examine Nova and Neutron logs around security group application events for mismatched veth names; review instance interface configurations and packet flow logs for evidence of bypassed filters.

What your security team should do

• Upgrade all Nova-LXD deployments to the fixed version immediately
• Re-apply and validate security group rules after upgrade
• Audit network logs for any prior bypass attempts