OSSN-0069: Host machine exposed to tenant networks via IPv6

Summary

New interfaces created by Neutron in the default namespace, were done so without disabling IPv6 link-local addresses. This resulted in instances gaining the ability to directly access the host OS, therefore breaking guest isolation.

In Linux, link-local IPv6 addresses are assigned to all active interfaces, unlike IPv4 addresses where an administrator must configure each interface explicitly. This leads to a time window between when the interface is enabled and when it is attached to bridge device. Within this time window the host could be accessed from a tenant network.

IPv6 is now disabled automatically by both Neutron and Nova, prior to bringing any links up, however operators should still be aware of the security risks associated with re-enabling IPv6 link-local addresses.

Affected Services / Software

Nova, Neutron, networking-midonet, Kilo, Liberty

Discussion

Linux assigns link-local IPv6 addresses to all the active interfaces, which is different to that of IPv4 addresses, where an administrator must configure each interface explicitly. Once an interface is enslaved in a bridge, all addresses assigned to it are ignored and only the addresses on the bridge are active. They are exposed via LinuxBridgeManager calls to ensure_vlan and ensure_vxlan where a new VLAN or VXLAN interface is created prior to enslaving the interfaces in the bridge.

Both Neutron and Nova now disable IPv6 on all interfaces before bringing the interface up. This avoids exposing a time window between when the interface is enabled and when it is attached to a bridge device, during which time the host could be accessible from a tenant network.

Contacts / References

Author: Vinay Potluri, Intel & Luke Hinds, Red Hat