CVE-2023-1668

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1668
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2137666 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5387 Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/04/06/1 Mailing List Mitigation Patch
https://bugzilla.redhat.com/show_bug.cgi?id=2137666 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/
https://security.gentoo.org/glsa/202311-16
https://www.debian.org/security/2023/dsa-5387 Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/04/06/1 Mailing List Mitigation Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudbase:open_vswitch:3.1.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:17.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:redhat:fast_datapath:-:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
History

21 Nov 2024, 07:39

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=2137666 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2137666 - Issue Tracking, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html - () https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/ -
References () https://security.gentoo.org/glsa/202311-16 - () https://security.gentoo.org/glsa/202311-16 -
References () https://www.debian.org/security/2023/dsa-5387 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5387 - Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2023/04/06/1 - Mailing List, Mitigation, Patch () https://www.openwall.com/lists/oss-security/2023/04/06/1 - Mailing List, Mitigation, Patch

26 Nov 2023, 11:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/', 'name': 'FEDORA-2023-7da03dc2ae', 'tags': [], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/ -
  • () https://security.gentoo.org/glsa/202311-16 -

01 May 2023, 06:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html -

23 Apr 2023, 00:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2GUNS3WSJG4TUDKZ5L7FXGJMVOD6EJZ/ -

21 Apr 2023, 15:38

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-10 22:15

Updated : 2024-11-21 07:39

NVD link : CVE-2023-1668

Mitre link : CVE-2023-1668

CVE.ORG link : CVE-2023-1668

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • openstack_platform
  • virtualization
  • fast_datapath
  • openshift_container_platform

cloudbase

  • open_vswitch

debian

  • debian_linux
CWE
CWE-670

Always-Incorrect Control Flow Implementation