CVE-2023-3966
Published: 8 February 2024
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
Notes
| Author | Note |
|---|---|
| amurray | According to the upstream advisory only affects version 2.12 and newer but the mentioned commit which introduced this bug (https://github.com/openvswitch/ovs/commit/a468645c6d33) was shipped in 2.11.0 as well so assuming this is also affected. |
Mitigation
Disable flow hardware offload if enabled via the following setting and
reboot:
other_config:hw-offload=false
Priority
Status
| Package | Release | Status |
|---|---|---|
|
openvswitch Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Released
(2.13.8-0ubuntu1.4)
|
|
| jammy |
Released
(2.17.9-0ubuntu0.22.04.1)
|
|
| mantic |
Released
(3.2.2-0ubuntu0.23.10.1)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(2.17.9,3.0.6,3.1.4,3.2.2)
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
Patches: upstream: https://github.com/openvswitch/ovs/commit/be695f26fd5667bcc86d78954c4c783979088ead upstream: https://github.com/openvswitch/ovs/commit/2cfbcd5247ed0fd941c1ebb9f4adb952b67fe13a upstream: https://github.com/openvswitch/ovs/commit/91e621bd5abab19954bec09c7d27c59acdf607b1 upstream: https://github.com/openvswitch/ovs/commit/935cd1d574c6f432a451df8941374ffb36d767d9 upstream: https://github.com/openvswitch/ovs/commit/b8657dada9641fbd2bd3a3f882e0862448d60910 |
||