Description =========== Multiple versions of Open vSwitch are vulnerable to crafted Geneve packets causing invalid memory accesses and potential denial of service. Triggering the vulnerability requires that Open vSwitch has flow hardware offload with Linux TC flower enabled (other_config:hw-offload=true). It is not enabled by default.
The issue is caused by insufficient validation of Geneve metadata fields in the offload path. Open vSwitch versions 2.12 and newer are affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned CVE-2023-3966 identifier to this issue. Mitigation ========== For any version of Open vSwitch, disabling flow hardware offload will prevent the issue (setting other_config:hw-offload=false and reboot the system). We do not recommend attempting to mitigate the vulnerability this way because it may impact the overall system throughput. By default, flow hardware offload support is not enabled. Fix === Patches to fix this vulnerability in Open vSwitch 2.17 and newer: * 3.2.x: https://github.com/openvswitch/ovs/commit/2cfbcd5247ed0fd941c1ebb9f4adb952b67fe13a * 3.1.x: https://github.com/openvswitch/ovs/commit/91e621bd5abab19954bec09c7d27c59acdf607b1 * 3.0.x: https://github.com/openvswitch/ovs/commit/935cd1d574c6f432a451df8941374ffb36d767d9 * 2.17.x: https://github.com/openvswitch/ovs/commit/b8657dada9641fbd2bd3a3f882e0862448d60910 Original patch is located at: https://mail.openvswitch.org/pipermail/ovs-dev/2024-February/411702.html Recommendation ============== We recommend that users of Open vSwitch apply the linked patches, or upgrade to a known patched version of Open vSwitch. These include: * v3.2.2 * v3.1.4 * v3.0.6 * v2.17.9 Acknowledgments =============== The Open vSwitch team wishes to thank the reporters: Timothy Redaelli <tredae...@redhat.com> Haresh Khandelwal <hakha...@redhat.com>
OpenPGP_0xB9F7EC77C829BF96.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ discuss mailing list disc...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
