Description
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.
References (6)
Scores
CVSS v3
8.2
EPSS
0.0028
EPSS Percentile
51.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-670
Status
published
Products (9)
cloudbase/open_vswitch
3.1.0
cloudbase/open_vswitch
1.5.0 - 2.13.11
debian/debian_linux
11.0
redhat/fast_datapath
redhat/openshift_container_platform
4.0
redhat/openstack_platform
16.1
redhat/openstack_platform
16.2
redhat/openstack_platform
17.0
redhat/virtualization
4.0
Published
Apr 10, 2023
Tracked Since
Feb 18, 2026