Security features bypass in Open Virtual Network - CVE-2025-0650

Vulnerability identifier: #VU103659

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L]

CVE-ID: CVE-2025-0650

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper handling of UDP packets. A remote attacker can send specially crafted UDP packets that bypass egress access control lists (ACLs) in OVN installations and gain unauthorized access to virtual machines and containers running on the OVN network.

Successful exploitation of the vulnerability requires that ACLs on OVN installations are configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured.

Open Virtual Network
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux Fast Datapath (for RHEL Server for IBM Power LE)
Red Hat Enterprise Linux Fast Datapath (for RHEL for ARM 64)
Red Hat Enterprise Linux Fast Datapath (for IBM z Systems)
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
Red Hat Enterprise Linux Fast Datapath
libopenvswitch-2_11-0-debuginfo
libopenvswitch-2_11-0
openvswitch-debuginfo
openvswitch
openvswitch-debugsource
openvswitch-vtep
libopenvswitch-2_14-0-debuginfo
openvswitch-pki
openvswitch-test
openvswitch-test-debuginfo
openvswitch-devel
openvswitch-ipsec
openvswitch-vtep-debuginfo
python3-ovs
libopenvswitch-2_14-0
openvswitch-doc
openvswitch3-doc
openvswitch3-vtep-debuginfo
openvswitch3-debuginfo
openvswitch3
openvswitch3-vtep
openvswitch3-test-debuginfo
openvswitch3-devel
openvswitch3-debugsource
python3-ovs3
libopenvswitch-3_1-0
openvswitch3-pki
openvswitch3-test
openvswitch3-ipsec
libopenvswitch-3_1-0-debuginfo
ovn-docker (Ubuntu package)
ovn-host (Ubuntu package)
ovn-central (Ubuntu package)
ovn-common (Ubuntu package)
ovn-ic (Ubuntu package)
libovn-20_06-0-debuginfo
ovn-host
ovn-doc
ovn-vtep
ovn-docker
libovn-20_06-0
ovn
ovn-vtep-debuginfo
ovn-central
ovn-host-debuginfo
ovn-devel
ovn-debuginfo
ovn-central-debuginfo
ovn22.03 (Red Hat package)
ovn22.06 (Red Hat package)
ovn22.09 (Red Hat package)
ovn22.12 (Red Hat package)
libovn-23_03-0-debuginfo
ovn3-central-debuginfo
libovn-23_03-0
ovn3-host-debuginfo
ovn3-vtep-debuginfo
ovn3-devel
ovn3-vtep
ovn3-central
ovn3-doc
ovn3
ovn3-docker
ovn3-host
ovn3-debuginfo
ovn23.03 (Red Hat package)
ovn23.06 (Red Hat package)
ovn23.09 (Red Hat package)
ovn24.03 (Red Hat package)
ovn24.09 (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Open Virtual Network - addressed in versions 22.03.8, 24.03.5, 24.09.2
libopenvswitch-2_11-0-debuginfo - update to 2.11.5-3.24.2
libopenvswitch-2_11-0 - update to 2.11.5-3.24.2
openvswitch-debuginfo - addressed in versions 2.11.5-3.24.2, 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch - addressed in versions 2.11.5-3.24.2, 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-debugsource - addressed in versions 2.11.5-3.24.2, 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-vtep - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
libopenvswitch-2_14-0-debuginfo - update to 2.14.2-150400.24.26.1
openvswitch-pki - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-test - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-test-debuginfo - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-devel - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-ipsec - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch-vtep-debuginfo - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
python3-ovs - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
libopenvswitch-2_14-0 - update to 2.14.2-150400.24.26.1
openvswitch-doc - addressed in versions 2.14.2-150400.24.26.1, 3.1.0-150600.33.6.1
openvswitch3-doc - update to 3.1.0-150500.3.22.1
openvswitch3-vtep-debuginfo - update to 3.1.0-150500.3.22.1
openvswitch3-debuginfo - update to 3.1.0-150500.3.22.1
openvswitch3 - update to 3.1.0-150500.3.22.1
openvswitch3-vtep - update to 3.1.0-150500.3.22.1
openvswitch3-test-debuginfo - update to 3.1.0-150500.3.22.1
openvswitch3-devel - update to 3.1.0-150500.3.22.1
openvswitch3-debugsource - update to 3.1.0-150500.3.22.1
python3-ovs3 - update to 3.1.0-150500.3.22.1
libopenvswitch-3_1-0 - addressed in versions 3.1.0-150500.3.22.1, 3.1.0-150600.33.6.1
openvswitch3-pki - update to 3.1.0-150500.3.22.1
openvswitch3-test - update to 3.1.0-150500.3.22.1
openvswitch3-ipsec - update to 3.1.0-150500.3.22.1
libopenvswitch-3_1-0-debuginfo - addressed in versions 3.1.0-150500.3.22.1, 3.1.0-150600.33.6.1
Red Hat OpenShift Container Platform - addressed in versions 4.12.77, 4.14.51
ovn-docker (Ubuntu package) - addressed in versions 20.03.2-0ubuntu0.20.04.6, 22.03.3-0ubuntu0.22.04.5, 24.03.2-0ubuntu0.24.04.2, 24.09.0-1ubuntu0.1
ovn-host (Ubuntu package) - addressed in versions 20.03.2-0ubuntu0.20.04.6, 22.03.3-0ubuntu0.22.04.5, 24.03.2-0ubuntu0.24.04.2, 24.09.0-1ubuntu0.1
ovn-central (Ubuntu package) - addressed in versions 20.03.2-0ubuntu0.20.04.6, 22.03.3-0ubuntu0.22.04.5, 24.03.2-0ubuntu0.24.04.2, 24.09.0-1ubuntu0.1
ovn-common (Ubuntu package) - addressed in versions 20.03.2-0ubuntu0.20.04.6, 22.03.3-0ubuntu0.22.04.5, 24.03.2-0ubuntu0.24.04.2, 24.09.0-1ubuntu0.1
ovn-ic (Ubuntu package) - addressed in versions 20.03.2-0ubuntu0.20.04.6, 22.03.3-0ubuntu0.22.04.5, 24.03.2-0ubuntu0.24.04.2, 24.09.0-1ubuntu0.1
libovn-20_06-0-debuginfo - update to 20.06.2-150400.24.26.1
ovn-host - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-doc - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-vtep - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-docker - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
libovn-20_06-0 - update to 20.06.2-150400.24.26.1
ovn - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-vtep-debuginfo - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-central - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-host-debuginfo - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-devel - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-debuginfo - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn-central-debuginfo - addressed in versions 20.06.2-150400.24.26.1, 23.03.0-150600.33.6.1
ovn22.03 (Red Hat package) - addressed in versions 22.03.7-11.el8fdp, 22.03.7-11.el9fdp
ovn22.06 (Red Hat package) - addressed in versions 22.06.0-273.el8fdp, 22.06.0-273.el9fdp
ovn22.09 (Red Hat package) - addressed in versions 22.09.2-86.el8fdp, 22.09.2-86.el9fdp
ovn22.12 (Red Hat package) - addressed in versions 22.12.1-107.el8fdp, 22.12.1-107.el9fdp
libovn-23_03-0-debuginfo - addressed in versions 23.03.0-150500.3.22.1, 23.03.0-150600.33.6.1
ovn3-central-debuginfo - update to 23.03.0-150500.3.22.1
libovn-23_03-0 - addressed in versions 23.03.0-150500.3.22.1, 23.03.0-150600.33.6.1
ovn3-host-debuginfo - update to 23.03.0-150500.3.22.1
ovn3-vtep-debuginfo - update to 23.03.0-150500.3.22.1
ovn3-devel - update to 23.03.0-150500.3.22.1
ovn3-vtep - update to 23.03.0-150500.3.22.1
ovn3-central - update to 23.03.0-150500.3.22.1
ovn3-doc - update to 23.03.0-150500.3.22.1
ovn3 - update to 23.03.0-150500.3.22.1
ovn3-docker - update to 23.03.0-150500.3.22.1
ovn3-host - update to 23.03.0-150500.3.22.1
ovn3-debuginfo - update to 23.03.0-150500.3.22.1
ovn23.03 (Red Hat package) - addressed in versions 23.03.3-22.el8fdp, 23.03.3-22.el9fdp
ovn23.06 (Red Hat package) - addressed in versions 23.06.4-26.el8fdp, 23.06.4-26.el9fdp
ovn23.09 (Red Hat package) - update to 23.09.6-12.el9fdp
ovn24.03 (Red Hat package) - update to 24.03.4-53.el9fdp
ovn24.09 (Red Hat package) - update to 24.09.1-66.el9fdp

• http://www.openwall.com/lists/oss-security/2025/01/22/11
• https://bugzilla.redhat.com/show_bug.cgi?id=2339537
• https://www.openwall.com/lists/oss-security/2025/01/22/5
• https://github.com/ovn-org/ovn/commit/f22a1ba9c127795bebcfbd41d772bb071f893a6d
• https://github.com/ovn-org/ovn/commit/70618a65fd49f1d1d5498927c0bed63e296dafb7
• https://github.com/ovn-org/ovn/commit/249c52ad011cacb4c182dc64e88977ac7c61f668
• https://mail.openvswitch.org/pipermail/ovs-dev/2025-January/419993.html

• Access control lists bypass in Open Virtual Network (OVN)
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn22.03
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn22.06
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn22.09
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn22.12
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn23.03
• Fast Datapath for Red Hat Enterprise Linux 8 update for ovn23.06
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn22.03
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn22.06
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn22.09
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn22.12
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn23.03
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn23.06
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn23.09
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn24.03
• Fast Datapath for Red Hat Enterprise Linux 9 update for ovn24.09
• SUSE update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch3
• Ubuntu update for ovn
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12