CVE-2023-1668: A flaw was found in openvswitch (OVS)

Description

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.2% · higher than 68% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DL

Debian Linux · Debian

11.0 · source: NVD

FD

Fast Datapath · Redhat

All versions, or not specified · source: NVD

OV

Open Vswitch · Cloudbase

1.5.0 before 2.13.11; 2.14.0 before 2.14.9; 2.15.0 before 2.15.8; 2.16.0 before 2.16.7; 2.17.0 before 2.17.6; 3.0.0 before 3.0.4; +1 more · source: NVD

OC

Openshift Container Platform · Redhat

4.0 · source: NVD

OP

Openstack Platform · Redhat

16.1; 16.2; 17.0 · source: NVD

VI

Virtualization · Redhat

4.0 · source: NVD