Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2023-1668

Опубликовано: 06 апр. 2023
Источник: redhat
CVSS3: 8.2

Описание

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

Отчет

In OpenShift Container Platform (OCP) the openvswitch rpm package is consumed from the RHEL Fast Datapath repositories, hence OCP openvswitch components are marked as "Will not fix".

Меры по смягчению последствий

For any version of Open vSwitch, preventing packets with network protocol number '0' from reaching Open vSwitch will prevent the issue. This is difficult to achieve because Open vSwitch obtains packets before the iptables or nftables host firewall, so iptables or nftables on the Open vSwitch host cannot ordinarily block the vulnerability. Another method would be to add a high priority flow to the flow table explicitly matching on nw protocol '0' and handling that traffic separately: table=0 priority=32768,ip,ip_proto=0 actions=drop This would need to be similarly done for IPv6 traffic as well.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Fast Datapath for RHEL 7openvswitchOut of support scope
Fast Datapath for RHEL 7openvswitch2.10Out of support scope
Fast Datapath for RHEL 7openvswitch2.11Out of support scope
Fast Datapath for RHEL 7openvswitch2.12Out of support scope
Fast Datapath for RHEL 7openvswitch2.13Out of support scope
Fast Datapath for RHEL 8openvswitch2.11Out of support scope
Fast Datapath for RHEL 8openvswitch2.12Out of support scope
Fast Datapath for RHEL 8openvswitch2.16Out of support scope
Fast Datapath for RHEL 9openvswitch3.0Out of support scope
Red Hat Enterprise Linux 7openvswitchOut of support scope

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-670
https://bugzilla.redhat.com/show_bug.cgi?id=2137666openvswitch: ip proto 0 triggers incorrect handling

8.2 High

CVSS3

Связанные уязвимости

CVSS3: 8.2
ubuntu
почти 3 года назад

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

CVSS3: 8.2
nvd
почти 3 года назад

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

CVSS3: 8.2
msrc
почти 3 года назад

Описание отсутствует

CVSS3: 8.2
debian
почти 3 года назад

A flaw was found in openvswitch (OVS). When processing an IP packet wi ...

suse-cvrf
больше 2 лет назад

Security update for openvswitch

8.2 High

CVSS3