REDHAT-BUG-2453458: Medium severity Open vSwitch ovn-controller vulnerability

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   Where feasible, change ACL rules that currently reject traffic to drop instead, to avoid triggering ICMP Destination Unreachable or Packet Too Big responses that can leak memory.

   Network ACLs / virtual switch ACLs action = drop (do not generate ICMP errors)
2. Compensating control

   At the hypervisor/virtual-switch or network edge, filter or block packets whose IP header total-length fields are inconsistent with the observed packet size (e.g., declared length larger than actual buffer). Restrict or isolate tenant VMs' ability to send such malformed packets toward components that generate ICMP error responses until the code fix is deployed.

3. Operational

   Modify ovn-controller to validate the IP header's declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) against the actual packet buffer size before copying packet data into ICMP error bodies. Add bounds checking and sanitize the length used when constructing ICMP Destination Unreachable and Packet Too Big responses; deploy the code fix to affected instances.

Event History

Frequently Asked Questions