CVE-2021-20267

What it actually does

The default Open vSwitch firewall rules in OpenStack Neutron fail to enforce proper IPv6 neighbor discovery and address ownership checks, allowing a compromised instance to send crafted packets that spoof IPv6 addresses belonging to other instances on the same virtual network.

Why it matters to the business

Attackers controlling a single virtual machine can disrupt network connectivity for other tenants or intercept traffic, leading to service outages, data exposure risks, and potential compliance violations in multi-tenant cloud environments using Open vSwitch.

How an attack unfolds

An attacker who has gained control of a virtual machine instance connected to an affected Open vSwitch deployment crafts malicious IPv6 packets (such as forged Neighbor Advertisement or Solicitation messages) that bypass the default firewall rules, enabling address impersonation for denial of service or traffic interception against other systems on the virtual network.

How to fix it

Upgrade OpenStack Neutron to version 15.3.3 or later, 16.3.1 or later, or 17.1.1 or later depending on the deployed release train. Apply the corrected firewall rule sets for the Open vSwitch driver and restart the relevant Neutron agents. If immediate upgrade is not possible, restrict tenant network access and monitor for anomalous IPv6 traffic.

How to confirm the fix worked

Verify that Neutron packages match or exceed the fixed versions listed above, inspect the applied OVS firewall rules for proper IPv6 spoofing protections, and test by attempting IPv6 address impersonation from a test instance to confirm the rules now block unauthorized packets.

Typical attack path

1. Gain control of a virtual machine instance attached to the Open vSwitch network
2. Craft and transmit malicious IPv6 neighbor discovery packets from that instance
3. Impersonate IPv6 addresses of other instances to trigger DoS or redirect traffic
4. Exfiltrate intercepted data or maintain the disruption for operational impact

How to detect it

Review Neutron and Open vSwitch logs for repeated or anomalous IPv6 Neighbor Advertisement/Solicitation packets originating from instances, correlate with tenant VM activity logs, and search for unexpected changes in OVS flow tables related to IPv6 address bindings.

What your security team should do

• Prioritize patching all OpenStack deployments using the Open vSwitch driver within the next maintenance window given the multi-year exposure window
• Audit current Neutron configurations to confirm only supported OVS firewall drivers are in use
• Implement network segmentation and least-privilege tenant isolation as a compensating control
• Add monitoring for unusual IPv6 neighbor discovery traffic volumes in virtual networks