CVE-2023-1668: High severity open vswitch vulnerability
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nwproto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
Other sources
When processing a IP packet with protocol 0, OVS will install datapath flow without action modifying ip header.
This results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nwproto is wilcarded) for this flow but with an incorrect action. This may result in incorrect handling of other IP packets with a != 0 IP protocol that match this dp flow. Such a mishandling might be triggered/exploited remotely.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2023-1668.
What is the severity of CVE-2023-1668?
CVE-2023-1668 has a severity value of 8.2 (high).
What is the affected software for CVE-2023-1668?
The affected software for CVE-2023-1668 includes openvswitch versions 1.5.0 to 2.13.11, 2.14.0 to 2.14.9, 2.15.0 to 2.15.8, 2.16.0 to 2.16.7, 2.17.0 to 2.17.6, and 3.0.0 to 3.0.4.
How can I fix the vulnerability CVE-2023-1668?
To fix the vulnerability CVE-2023-1668, update openvswitch to version 2.10.7+ds1-0+deb10u4, 2.15.0+ds1-2+deb11u4, 3.1.0-2, or 3.2.0-2, depending on your distribution.
Where can I find more information about CVE-2023-1668?
More information about CVE-2023-1668 can be found in the references: https://www.openwall.com/lists/oss-security/2023/04/06/1, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2186245, and https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2186246.