Description ===========

Mitigation ==========

Fix ===

The original patch is located at: https://mail.openvswitch.org/pipermail/ovs-dev/2025-January/419993.html

Recommendation ============== v22.03.8 v24.03.5 v24.09.2

Acknowledgments ===============

The OVN team wishes to thank the reporters:

Marius Berntsberg - marius () redpill-linpro com Trygve Vea - tv () redpill-linpro com Tore Anderson - tore () redpill-linpro com Rodolfo Alonso - ralonsoh () redhat com Jay Faulkner (Openstack VMT) - jay () jvf cc Brian Haley (Openstack/Neutron) - haleyb.dev () gmail com

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nwproto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, aka a Tuple Space Explosion (TSE) attack.

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decodeNXASTRAWENCAP (called from ofpactdecode and ofpactsdecode) during the decoding of a RAWENCAP action.

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

In Open vSwitch there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in lib/ofp-util.c in the function ofputilpullofp15groupmod.

References:

https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332965.html

In lib/conntrack.c in the firewall implementation in Open vSwitch, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions extractl3ipv6, extractl4tcp, and extractl4udp that can be triggered remotely.

References:

https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/329323.html

In Open vSwitch while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch.

References:

https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332966.html

A vulnerability in openvswitch was found. While parsing an OFPTQUEUEGETCONFIGREPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function ofputilpullqueuegetconfigreply10 in lib/ofp-util.c.

References:

https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332711.html

In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in lib/flow.c in the function miniflowextract, permitting remote bypass of the access control list enforced by the switch.