Log in Start free

Vulnerability · Published Oct 6, 2023 · Assigned by redhat

CVE-2023-5366Openvswitch don't match packets on nd_target field

High 7.1

In plain English

A high-severity insufficient verification of data authenticity in Fedora from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 63.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openvswitch2.17.9-r0ALPINE-CVE-2023-5366
Alpine:v3.21openvswitch2.17.9-r0ALPINE-CVE-2023-5366
Alpine:v3.22openvswitch2.17.9-r0ALPINE-CVE-2023-5366
Alpine:v3.23openvswitch2.17.9-r0ALPINE-CVE-2023-5366
Alpine:v3.24openvswitch2.17.9-r0ALPINE-CVE-2023-5366
Debian:12openvswitch3.1.0-2+deb12u1DSA-5640-1
Debian:12openvswitch3.1.0-2+deb12u1DEBIAN-CVE-2023-5366
Debian:13openvswitch3.1.2-1DEBIAN-CVE-2023-5366
Debian:14openvswitch3.1.2-1DEBIAN-CVE-2023-5366
Ubuntu:22.04:LTSopenvswitch2.17.9-0ubuntu0.22.04.1UBUNTU-CVE-2023-5366
Ubuntu:22.04:LTSopenvswitch2.17.9-0ubuntu0.22.04.1USN-6690-1

Affected products (as reported)

VendorProductVersions
n/a openvswitch see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat OpenShift Container Platform 3.11 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenStack Platform 16.1 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat Virtualization 4 see references
Red Hat Red Hat Virtualization 4 see references
Fedora Fedora see references

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

References