Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7f0dd23b-5273-42c4-8543-6f7b93364017@ovn.org>
Date: Thu, 8 Feb 2024 21:14:18 +0100
From: Ilya Maximets <i.maximets@....org>
To: oss-security@...ts.openwall.com, ovs-announce@...nvswitch.org,
 ovs-discuss <ovs-discuss@...nvswitch.org>
Cc: i.maximets@....org, Aaron Conole <aconole@...hat.com>,
 Flavio Leitner <fbl@...hat.com>
Subject: [ADVISORY] CVE-2023-3966: Open vSwitch: Invalid memory access in
 Geneve with HW offload.

Description
===========

Multiple versions of Open vSwitch are vulnerable to crafted Geneve
packets causing invalid memory accesses and potential denial of service.
Triggering the vulnerability requires that Open vSwitch has flow hardware
offload with Linux TC flower enabled (other_config:hw-offload=true).
It is not enabled by default.

The issue is caused by insufficient validation of Geneve metadata
fields in the offload path.  Open vSwitch versions 2.12 and newer are
affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned CVE-2023-3966 identifier to this issue.


Mitigation
==========

For any version of Open vSwitch, disabling flow hardware offload will
prevent the issue (setting other_config:hw-offload=false and reboot
the system).  We do not recommend attempting to mitigate the vulnerability
this way because it may impact the overall system throughput.

By default, flow hardware offload support is not enabled.


Fix
===

Patches to fix this vulnerability in Open vSwitch 2.17 and newer:

 * 3.2.x:
   https://github.com/openvswitch/ovs/commit/2cfbcd5247ed0fd941c1ebb9f4adb952b67fe13a
 * 3.1.x:
   https://github.com/openvswitch/ovs/commit/91e621bd5abab19954bec09c7d27c59acdf607b1
 * 3.0.x:
   https://github.com/openvswitch/ovs/commit/935cd1d574c6f432a451df8941374ffb36d767d9
 * 2.17.x:
   https://github.com/openvswitch/ovs/commit/b8657dada9641fbd2bd3a3f882e0862448d60910

Original patch is located at:
  https://mail.openvswitch.org/pipermail/ovs-dev/2024-February/411702.html


Recommendation
==============

We recommend that users of Open vSwitch apply the linked patches, or
upgrade to a known patched version of Open vSwitch.  These include:

 * v3.2.2
 * v3.1.4
 * v3.0.6
 * v2.17.9


Acknowledgments
===============

The Open vSwitch team wishes to thank the reporters:

  Timothy Redaelli <tredaelli@...hat.com>
  Haresh Khandelwal <hakhande@...hat.com>
Download attachment "OpenPGP_0xB9F7EC77C829BF96.asc" of type "application/pgp-keys" (6329 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.