CVE-2017-5936: Insufficient Information (NVD-CWE-noinfo)
value: OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2017-04-12T22:59Z
Repository: https://github.com/openstack/nova-lxd
Language: Python
Files changed: nova_lxd/nova/virt/lxd/config.py, setup.cfg
Commit date: 2017-01-31 12:06:22 +0000
Commit message: Ensure LXD veth host device is named correctly

LXD uses a veth pair to plumb the LXD instance into the bridge
providing access to neutron networking.

In later nova-lxd versions, the host_name parameter is set based
on the neutron configured name for the host part of the pair,
ensuring that neutron iptables firewall rules are correctly
applied to instances.

Update the mitaka version of the driver to populate the LXD
network device configuration to ensure that any firewall
rules are correctly applied.

(also dropped version from setup.cfg, as pbr will automatically
generate the version based on git tags, so its really surplus
to requirements).

Change-Id: Ic5b9ad6944a1ac45cd1983d038431252ff738985
Closes-Bug: 1656847

Diff: diff --git a/nova_lxd/nova/virt/lxd/config.py b/nova_lxd/nova/virt/lxd/config.py
index 0f311c0..5a2b884 100644
--- a/nova_lxd/nova/virt/lxd/config.py
+++ b/nova_lxd/nova/virt/lxd/config.py
@@ -222,15 +222,19 @@ class LXDContainerConfig(object):
             if not network_info:
                 return
 
             for vifaddr in network_info:
                 cfg = self.vif_driver.get_config(instance, vifaddr)
-                network_devices[str(cfg['bridge'])] = \
+                key = str(cfg['bridge'])
+                network_devices[key] = \
                     {'nictype': 'bridged',
                      'hwaddr': str(cfg['mac_address']),
-                     'parent': str(cfg['bridge']),
+                     'parent': key,
                      'type': 'nic'}
+                host_device = self.vif_driver.get_vif_devname(vifaddr)
+                if host_device:
+                    network_devices[key]['host_name'] = host_device
                 return network_devices
         except Exception as ex:
             with excutils.save_and_reraise_exception():
                 LOG.error(
                     _LE('Fail to configure network for %(instance)s: %(ex)s'),
diff --git a/setup.cfg b/setup.cfg
index 45feda3..23ba223 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,11 +1,10 @@
 [metadata]
 name = nova-lxd
 summary = native lxd driver for openstack
 description-file =
     README.md
-version = 13.2.0
 author = OpenStack
 author-email = openstack-dev@lists.openstack.org
 home-page = http://www.openstack.org/
 classifier =
     Environment :: OpenStack

Vulnerable code:                 network_devices[str(cfg['bridge'])] = \
                     'parent': str(cfg['bridge']),
version = 13.2.0
Fixed code:                 key = str(cfg['bridge'])
                network_devices[key] = \
                     'parent': key,
                host_device = self.vif_driver.get_vif_devname(vifaddr)
                if host_device:
                    network_devices[key]['host_name'] = host_device