Every CVE Search/ Get API key

CVE-2021-38598

OpenStack Neutron vulnerable to hardware address impersonation

9.1 CriticalFix available

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

1.22%Up 0.7 points since Aug 23, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
CVE-2021-38598
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-290
Updated
2026-11-02
CVE List No score

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
CVE-2021-38598
Updated
2026-11-02
EUVDEUVD-2021-0144 No score

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
EUVD-2021-0144
Updated
2026-11-03
GitHub AdvisoriesGHSA-hvm4-mc7m-22w4 8.8

OpenStack Neutron vulnerable to hardware address impersonation

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
GHSA-hvm4-mc7m-22w4
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSV 9.1

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
CVE-2021-38598
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-38598 9.1

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
DEBIAN-CVE-2021-38598
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-hvm4-mc7m-22w4 8.8

OpenStack Neutron vulnerable to hardware address impersonation

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
GHSA-hvm4-mc7m-22w4
CVSS 4.0
8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSVUBUNTU-CVE-2021-38598 9.1

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
UBUNTU-CVE-2021-38598
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2021-360 No score

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Record
PYSEC-2021-360
Updated
2026-11-02
OSVUSN-6067-1 No score

neutron vulnerabilities

David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-20267)

Jake Yip and Justin Mammarella discovered that OpenStack Neutron incorrectly handled the linuxbridge driver when ebtables-nft is being used. An attacker could possibly use this issue to impersonate the hardware addresss of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)

Pavel Toporkov discovered that OpenStack Neutron incorrectly handled extra_dhcp_opts values. An attacker could possibly use this issue to reconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40085)

Slawek Kaplonski discovered that OpenStack Neutron incorrectly handled the routes middleware. An attacker could possibly use this issue to cause the API worker to consume memory, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)

It was discovered that OpenStack Neutron incorrectly handled certain queries. A remote authenticated user could possibly use this issue to cause resource consumption, leading to a denial of service. (CVE-2022-3277)

Record
USN-6067-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
neutron
PyPI
 before 16.4.1
16.4.1
neutron
PyPI
 17.0.0 up to 17.1.3
17.1.3
neutron
PyPI
 18.0.0 to 18.0.0 None known
neutron
Debian:12
 before 2:18.1.0-2
2:18.1.0-2
neutron
Debian:13
 before 2:18.1.0-2
2:18.1.0-2
neutron
Debian:14
 before 2:18.1.0-2
2:18.1.0-2
neutron
PyPI
 before 16.4.1, plus listed versions
0.010.0.510.0.610.0.711.0.3
Show 45 moreShow less
11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1
16.4.1
neutron
PyPI
 17.0.0 up to 17.1.3, plus listed versions
17.1.017.1.117.1.2
17.1.3
neutron
PyPI
 Listed versions
18.0.0
 None known
neutron
PyPI
 before 16.4.1, 17.0.0 up to 17.1.3, 18.0.0 up to 18.1.0, plus listed versions
0.010.0.510.0.610.0.711.0.3
Show 45 moreShow less
11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1
16.4.117.1.318.1.0
Show 6 moreShow less
Affected packages
PackageAffectedFixed
neutron
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu22:8.0.0~b2-0ubuntu42:8.0.0~b2-0ubuntu52:8.0.0~b2-0ubuntu7
Show 20 moreShow less
2:8.0.0~b3-0ubuntu12:8.0.0~rc1-0ubuntu12:8.0.0-0ubuntu12:8.1.0-0ubuntu0.16.04.22:8.1.2-0ubuntu12:8.2.0-0ubuntu12:8.3.0-0ubuntu12:8.3.0-0ubuntu1.12:8.3.0-0ubuntu1.22:8.4.0-0ubuntu12:8.4.0-0ubuntu22:8.4.0-0ubuntu32:8.4.0-0ubuntu42:8.4.0-0ubuntu52:8.4.0-0ubuntu62:8.4.0-0ubuntu7.12:8.4.0-0ubuntu7.22:8.4.0-0ubuntu7.32:8.4.0-0ubuntu7.42:8.4.0-0ubuntu7.5
 None known
neutron
Ubuntu:18.04:LTS
 before 2:12.1.1-0ubuntu8.1, plus listed versions
2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1
Show 26 moreShow less
2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu8
2:12.1.1-0ubuntu8.1
neutron
Ubuntu:20.04:LTS
 before 2:16.4.2-0ubuntu6.2, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
Show 28 moreShow less
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.1
2:16.4.2-0ubuntu6.2
neutron
Ubuntu:18.04:LTS
From an advisory covering 5 CVEs
 before 2:12.1.1-0ubuntu8.1, plus listed versions
2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1
Show 26 moreShow less
2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu8
2:12.1.1-0ubuntu8.1
neutron
Ubuntu:20.04:LTS
From an advisory covering 5 CVEs
 before 2:16.4.2-0ubuntu6.2, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
Show 28 moreShow less
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.1
2:16.4.2-0ubuntu6.2
neutron
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 2:20.3.0-0ubuntu1.1, plus listed versions
2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu32:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu1
2:20.3.0-0ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38598 is a critical vulnerability (CVSS 9.1) in Openstack Neutron, published August 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in neutron 16.4.1.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 51 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open