CVE-2023-1668
moderate-risk
Published 2023-04-10
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
Do I need to act?
-
0.32% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.2/10
High
NETWORK
/ LOW complexity
Affected Products (9)
Open Vswitch
Open Vswitch
Fast Datapath
References (12)
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2137666
Third Party Advisory
https://www.debian.org/security/2023/dsa-5387
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2137666
Third Party Advisory
https://www.debian.org/security/2023/dsa-5387
44
/ 100
moderate-risk
Severity
28/34 · Critical
Exploitability
1/34 · Minimal
Exposure
15/34 · Moderate