Log in Start free

Vulnerability · Published Apr 10, 2023 · Assigned by redhat

CVE-2023-1668

High 8.2

In plain English

A high-severity security flaw in openvswitch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)1.2%top 31.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openvswitch2.17.6-r0, 2.17.8-r0ALPINE-CVE-2023-1668
Alpine:v3.21openvswitch2.17.6-r0, 2.17.8-r0ALPINE-CVE-2023-1668
Alpine:v3.22openvswitch2.17.6-r0, 2.17.8-r0ALPINE-CVE-2023-1668
Alpine:v3.23openvswitch2.17.6-r0, 2.17.8-r0ALPINE-CVE-2023-1668
Alpine:v3.24openvswitch2.17.6-r0, 2.17.8-r0ALPINE-CVE-2023-1668
Debian:12openvswitch3.1.0-2DEBIAN-CVE-2023-1668
Debian:13openvswitch3.1.0-2DEBIAN-CVE-2023-1668
Debian:14openvswitch3.1.0-2DEBIAN-CVE-2023-1668
Ubuntu:22.04:LTSopenvswitch2.17.5-0ubuntu0.22.04.2UBUNTU-CVE-2023-1668
Ubuntu:22.04:LTSopenvswitch2.17.5-0ubuntu0.22.04.2USN-6068-1

Affected products (as reported)

VendorProductVersions
n/a openvswitch unknown

Weakness: CWE-670 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References