CVE-2023-5366 Openvswitch don't match packets on nd_target field
MediumCVSS 5.5
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openvswitch(Debian:12) | < 3.1.0-2+deb12u1 | 3.1.0-2+deb12u1 |
| debian/openvswitch(Debian:12) | = 3.1.0-2 | No fix listed |
| debian/openvswitch(Debian:13) | < 3.1.2-1 | 3.1.2-1 |
| debian/openvswitch(Debian:14) | < 3.1.2-1 | 3.1.2-1 |
| redhat enterprise linux | All versions | No fix listed |
| redhat enterprise linux | = 7 | No fix listed |
| redhat enterprise linux | = 8 | No fix listed |
| redhat enterprise linux | = 9 | No fix listed |
| redhat openshift | = 3.11 | No fix listed |
| redhat openshift | = 4 | No fix listed |
| redhat openshift | All versions | No fix listed |
| redhat openstack | = 16.1 | No fix listed |
| redhat openstack | = 16.2 | No fix listed |
| redhat Red Hat Virtualization 4 | All versions | No fix listed |
| Fedora | All versions | No fix listed |
| ubuntu/openvswitch(Ubuntu:22.04) | < 2.17.9-0ubuntu0.22.04.1 | 2.17.9-0ubuntu0.22.04.1 |
| alpine/openvswitch(Alpine:v3.19) | < 2.17.9-r0 | 2.17.9-r0 |
| alpine/openvswitch(Alpine:v3.20) | < 2.17.9-r0 | 2.17.9-r0 |
| alpine/openvswitch(Alpine:v3.21) | < 2.17.9-r0 | 2.17.9-r0 |
| alpine/openvswitch(Alpine:v3.22) | < 2.17.9-r0 | 2.17.9-r0 |
| alpine/openvswitch(Alpine:v3.23) | < 2.17.9-r0 | 2.17.9-r0 |
| alpine/openvswitch(Alpine:v3.24) | < 2.17.9-r0 | 2.17.9-r0 |
| openvswitch | < 2023-02-28 | 2023-02-28 |
| redhat openshift container platform | = 4.0 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat fast datapath | All versions | No fix listed |
References
- Debian Security Tracker CVE-2023-5366 vendor-advisory
- access.redhat.com third-party-advisory vdb-entry
- RHBZ#2006347 issue-tracking patch third-party-advisory
- www.openwall.com
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- Ubuntu CVE tracker vendor-advisory
- USN-6514-1 vendor-advisory
- USN-6690-1 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory