Insufficient verification of data authenticity in Open vSwitch - CVE-2023-5366

Vulnerability identifier: #VU83434

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-5366

CWE-ID: CWE-345

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to missing verification of data authenticity when handling ICMPv6 Neighbor Advertisement packets between virtual machines. A local user can bypass OpenFlow rules and send otherwise restricted packets.

Open vSwitch
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Package Hub 15
Server Applications Module
Legacy Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Fedora
openvswitch-common (Ubuntu package)
openvswitch-help
openvswitch-devel
python3-openvswitch
openvswitch-debuginfo
openvswitch-debugsource
openvswitch
openvswitch-test-debuginfo
openvswitch-pki
openvswitch-ipsec
python3-ovs
openvswitch-vtep
openvswitch-vtep-debuginfo
libopenvswitch-2_13-0
openvswitch-test
libopenvswitch-2_13-0-debuginfo
python3-openvswitch (Ubuntu package)
libopenvswitch-2_14-0-debuginfo
libopenvswitch-2_14-0
openvswitch-doc
openvswitch (Debian package)
network-scripts-openvswitch
openvswitch-testcontroller
openvswitch3-ipsec
openvswitch3-vtep-debuginfo
openvswitch3-doc
openvswitch3-debuginfo
openvswitch3-test-debuginfo
python3-ovs3
openvswitch3-vtep
openvswitch3
openvswitch3-test
libopenvswitch-3_1-0
libopenvswitch-3_1-0-debuginfo
openvswitch3-pki
openvswitch3-debugsource
openvswitch3-devel
libovn-20_03-0
libovn-20_03-0-debuginfo
ovn-docker
ovn
ovn-devel
ovn-host
ovn-vtep
ovn-central
ovn-host-debuginfo
libovn-20_06-0-debuginfo
ovn-central-debuginfo
ovn-doc
libovn-20_06-0
ovn-debuginfo
ovn-vtep-debuginfo
ovn3-devel
libovn-23_03-0
ovn3-host-debuginfo
ovn3-host
ovn3
ovn3-central
ovn3-central-debuginfo
ovn3-debuginfo
libovn-23_03-0-debuginfo
ovn3-vtep
ovn3-vtep-debuginfo
ovn3-docker
ovn3-doc
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Open vSwitch - addressed in versions 2.17.9, 3.0.6, 3.1.4, 3.2.2
openvswitch-common (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.13.8-0ubuntu1.3, 2.13.8-0ubuntu1.4, 2.17.9-0ubuntu0.22.04.1, 3.2.2-0ubuntu0.23.10.1
openvswitch-help - update to 2.12.4-5
openvswitch-devel - update to 2.12.4-5
python3-openvswitch - update to 2.12.4-5
openvswitch-debuginfo - update to 2.12.4-5
openvswitch-debugsource - update to 2.12.4-5
openvswitch - update to 2.12.4-5
openvswitch-test-debuginfo - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-pki - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-devel - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-ipsec - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
python3-ovs - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-vtep - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-vtep-debuginfo - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
libopenvswitch-2_13-0 - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1
openvswitch-test - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-debugsource - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-debuginfo - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1, 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
libopenvswitch-2_13-0-debuginfo - addressed in versions 2.13.2-150200.9.25.1, 2.13.2-150200.9.28.1
python3-openvswitch (Ubuntu package) - addressed in versions 2.13.8-0ubuntu1.4, 2.17.9-0ubuntu0.22.04.1, 3.2.2-0ubuntu0.23.10.1
libopenvswitch-2_14-0-debuginfo - addressed in versions 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
libopenvswitch-2_14-0 - addressed in versions 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch-doc - addressed in versions 2.14.2-150300.19.11.1, 2.14.2-150300.19.14.1, 2.14.2-150400.24.14.2, 2.14.2-150400.24.17.1
openvswitch (Debian package) - addressed in versions 2.15.0+ds1-2+deb11u5, 3.1.0-2+deb12u1
network-scripts-openvswitch - update to 2.17.6-4
openvswitch - update to 2.17.6-4
openvswitch-devel - update to 2.17.6-4
openvswitch-ipsec - update to 2.17.6-4
openvswitch-testcontroller - update to 2.17.6-4
python3-openvswitch - update to 2.17.6-4
openvswitch-doc - update to 2.17.6-4
openvswitch-test - update to 2.17.6-4
openvswitch3-ipsec - update to 3.1.0-150500.3.11.1
openvswitch3-vtep-debuginfo - update to 3.1.0-150500.3.11.1
openvswitch3-doc - update to 3.1.0-150500.3.11.1
openvswitch3-debuginfo - update to 3.1.0-150500.3.11.1
openvswitch3-test-debuginfo - update to 3.1.0-150500.3.11.1
python3-ovs3 - update to 3.1.0-150500.3.11.1
openvswitch3-vtep - update to 3.1.0-150500.3.11.1
openvswitch3 - update to 3.1.0-150500.3.11.1
openvswitch3-test - update to 3.1.0-150500.3.11.1
libopenvswitch-3_1-0 - update to 3.1.0-150500.3.11.1
libopenvswitch-3_1-0-debuginfo - update to 3.1.0-150500.3.11.1
openvswitch3-pki - update to 3.1.0-150500.3.11.1
openvswitch3-debugsource - update to 3.1.0-150500.3.11.1
openvswitch3-devel - update to 3.1.0-150500.3.11.1
openvswitch - addressed in versions 3.2.2-1.fc39, 3.3.0-1.fc40
Red Hat OpenShift Container Platform - addressed in versions 4.12.58, 4.14.26, 4.15.14
libovn-20_03-0 - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1
libovn-20_03-0-debuginfo - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1
ovn-docker - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-devel - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-host - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-vtep - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-central - addressed in versions 20.03.1-150200.9.25.1, 20.03.1-150200.9.28.1, 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-host-debuginfo - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
libovn-20_06-0-debuginfo - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-central-debuginfo - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-doc - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
libovn-20_06-0 - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-debuginfo - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn-vtep-debuginfo - addressed in versions 20.06.2-150300.19.11.1, 20.06.2-150300.19.14.1, 20.06.2-150400.24.14.2, 20.06.2-150400.24.17.1
ovn3-devel - update to 23.03.0-150500.3.11.1
libovn-23_03-0 - update to 23.03.0-150500.3.11.1
ovn3-host-debuginfo - update to 23.03.0-150500.3.11.1
ovn3-host - update to 23.03.0-150500.3.11.1
ovn3 - update to 23.03.0-150500.3.11.1
ovn3-central - update to 23.03.0-150500.3.11.1
ovn3-central-debuginfo - update to 23.03.0-150500.3.11.1
ovn3-debuginfo - update to 23.03.0-150500.3.11.1
libovn-23_03-0-debuginfo - update to 23.03.0-150500.3.11.1
ovn3-vtep - update to 23.03.0-150500.3.11.1
ovn3-vtep-debuginfo - update to 23.03.0-150500.3.11.1
ovn3-docker - update to 23.03.0-150500.3.11.1
ovn3-doc - update to 23.03.0-150500.3.11.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2006347
• https://github.com/openvswitch/ovs/commit/489553b1c21692063931a9f50b6849b23128443c
• https://mail.openvswitch.org/pipermail/ovs-announce/2024-February/000339.html

• Security restrictions bypass in Open vSwitch
• SUSE update for openvswitch
• Ubuntu update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch
• SUSE update for openvswitch3
• SUSE update for openvswitch
• Fedora 40 update for openvswitch
• Fedora 39 update for openvswitch
• Ubuntu update for openvswitch
• openEuler update for openvswitch
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Debian update for openvswitch
• Anolis OS update for openvswitch