[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 8 Feb 2024 21:14:18 +0100
From: Ilya Maximets <i.maximets@....org>
To: oss-security@...ts.openwall.com, ovs-announce@...nvswitch.org,
ovs-discuss <ovs-discuss@...nvswitch.org>
Cc: i.maximets@....org, Aaron Conole <aconole@...hat.com>,
Flavio Leitner <fbl@...hat.com>
Subject: [ADVISORY] CVE-2023-3966: Open vSwitch: Invalid memory access in
Geneve with HW offload.
Description
===========
Multiple versions of Open vSwitch are vulnerable to crafted Geneve
packets causing invalid memory accesses and potential denial of service.
Triggering the vulnerability requires that Open vSwitch has flow hardware
offload with Linux TC flower enabled (other_config:hw-offload=true).
It is not enabled by default.
The issue is caused by insufficient validation of Geneve metadata
fields in the offload path. Open vSwitch versions 2.12 and newer are
affected.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned CVE-2023-3966 identifier to this issue.
Mitigation
==========
For any version of Open vSwitch, disabling flow hardware offload will
prevent the issue (setting other_config:hw-offload=false and reboot
the system). We do not recommend attempting to mitigate the vulnerability
this way because it may impact the overall system throughput.
By default, flow hardware offload support is not enabled.
Fix
===
Patches to fix this vulnerability in Open vSwitch 2.17 and newer:
* 3.2.x:
https://github.com/openvswitch/ovs/commit/2cfbcd5247ed0fd941c1ebb9f4adb952b67fe13a
* 3.1.x:
https://github.com/openvswitch/ovs/commit/91e621bd5abab19954bec09c7d27c59acdf607b1
* 3.0.x:
https://github.com/openvswitch/ovs/commit/935cd1d574c6f432a451df8941374ffb36d767d9
* 2.17.x:
https://github.com/openvswitch/ovs/commit/b8657dada9641fbd2bd3a3f882e0862448d60910
Original patch is located at:
https://mail.openvswitch.org/pipermail/ovs-dev/2024-February/411702.html
Recommendation
==============
We recommend that users of Open vSwitch apply the linked patches, or
upgrade to a known patched version of Open vSwitch. These include:
* v3.2.2
* v3.1.4
* v3.0.6
* v2.17.9
Acknowledgments
===============
The Open vSwitch team wishes to thank the reporters:
Timothy Redaelli <tredaelli@...hat.com>
Haresh Khandelwal <hakhande@...hat.com>
Download attachment "OpenPGP_0xB9F7EC77C829BF96.asc" of type "application/pgp-keys" (6329 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
