Assertion failure in Open vSwitch - CVE-2018-17204

Vulnerability identifier: #VU16578

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17204

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in parse_group_prop_ntr_selection_method in lib/ofp-util.c due to validation of the group type and command after the whole group mod has been decoded. A remote attacker can trigger an an assertion failure via OVS_NOT_REACHED when the OF1.5 decoder tries to use the type and command earlier, when it might still be invalid.

Open vSwitch
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization Host
Red Hat Virtualization Manager
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
openvswitch
Red Hat Enterprise Linux Fast Datapath
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Fedora
Opensuse

Install update from vendor's website.

redhat-release-virtualization-host (Red Hat package) - update to 4.2-7.5.el7
redhat-virtualization-host (Red Hat package) - update to 4.2-20181121.0.el7_6
openvswitch - update to 2.10.0-1.fc29

• https://github.com/openvswitch/ovs/commit/4af6da3b275b764b1afe194df6499b33d2bf4cde

• OpenSUSE Linux update for openvswitch
• Red Hat update for openvswitch
• Red Hat update for openvswitch
• Red Hat update for openvswitch
• Red Hat Virtualization update for Open vSwitch
• Fedora 29 update for openvswitch