CVE-2026-5367: Ovn: ovn: information disclosure via crafted dhcpv6 packets
A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.
Other sources
Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted DHCPv6 packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap.
OVN supports configuring DHCPv6 options for Logical Switch Ports. When configured we allow handling of DHCPv6 requests in a userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of creating a reply packet.
When building a DHCPv6 ADVERTISE reply, the handler echoes the Client ID option using the option's self-declared length without validating it against the actual packet bounds. A workload can send a crafted DHCPv6 SOLICIT with an inflated Client ID length field, causing ovn-controller to copy heap memory beyond the valid packet data into the reply. The reply is then delivered back to the attacker's VM port.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OVN (Open Virtual Network) ovn-controllerto a version that resolves this vulnerability.Patch CVE-2026-5367 - Configuration
In OVN, when configured we allow handling of DHCPv6 requests in a userspace—disable this userspace DHCPv6 request handling so attackers cannot trigger ovn-controller DHCPv6 Client ID processing.
OVN DHCPv6 handling (Logical Switch Ports) Allow handling of DHCPv6 requests in userspace = Disable - Compensating control
Limit access to the OVN DHCPv6 SOLICIT path/network segment so only trusted workload/VM ports can send DHCPv6 SOLICIT packets (the issue is triggered by crafted DHCPv6 SOLICIT with an inflated Client ID length).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5367?
CVE-2026-5367 is considered to have a moderate severity level due to the potential for information disclosure.
How do I fix CVE-2026-5367?
To mitigate CVE-2026-5367, update the Open vSwitch OVN to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-5367 enable?
CVE-2026-5367 enables a remote attacker to exploit crafted DHCPv6 SOLICIT packets to disclose information.
Which software is affected by CVE-2026-5367?
CVE-2026-5367 affects Open vSwitch OVN, specifically its handling of DHCPv6 packets.
What can be the impact of exploiting CVE-2026-5367?
The exploitation of CVE-2026-5367 can lead to unauthorized information disclosure from the ovn-controller.