Bugzilla – Bug 1216002
VUL-0: CVE-2023-5366: openvswitch: missing masks on a final stage with ports trie
Last modified: 2024-02-16 08:10:19 UTC
It is possible that VMs can send ICMPv6 Neighbor Advertisement packets to mis-direct traffic to them. It needs to first send packet with correct IP address in the nd_target field and quickly after that send packet with spoofed IP address. Upstream fix: https://github.com/openvswitch/ovs/commit/489553b1c21692063931a9f50b6849b23128443c Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2005408 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5366
Hi, The CVE fix is submitted to the below distributions , SLE-15-SP5 SLE-15-SP4 SLE-15-SP3 SLE-15-SP2 The CVE fix is already available on Factory and SLES15-SP5/SP6 with the newer versions of Openvswitch i.e v3.1.0. Hence marking the ticket as resolved.
SUSE-SU-2023:4508-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.3 (src): openvswitch-2.14.2-150300.19.11.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): openvswitch-2.14.2-150300.19.11.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): openvswitch-2.14.2-150300.19.11.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): openvswitch-2.14.2-150300.19.11.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): openvswitch-2.14.2-150300.19.11.1 SUSE Enterprise Storage 7.1 (src): openvswitch-2.14.2-150300.19.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4573-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.4 (src): openvswitch-2.14.2-150400.24.14.2 openSUSE Leap 15.5 (src): openvswitch-2.14.2-150400.24.14.2 Legacy Module 15-SP5 (src): openvswitch-2.14.2-150400.24.14.2 SUSE Package Hub 15 15-SP4 (src): openvswitch-2.14.2-150400.24.14.2 SUSE Package Hub 15 15-SP5 (src): openvswitch-2.14.2-150400.24.14.2 Server Applications Module 15-SP4 (src): openvswitch-2.14.2-150400.24.14.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4571-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): openvswitch-2.13.2-150200.9.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): openvswitch-2.13.2-150200.9.25.1 openSUSE Leap 15.4 (src): openvswitch-2.13.2-150200.9.25.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): openvswitch-2.13.2-150200.9.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4666-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.4 (src): openvswitch-2.13.2-150200.9.28.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): openvswitch-2.13.2-150200.9.28.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): openvswitch-2.13.2-150200.9.28.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): openvswitch-2.13.2-150200.9.28.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4661-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.4 (src): openvswitch-2.14.2-150400.24.17.1 openSUSE Leap 15.5 (src): openvswitch-2.14.2-150400.24.17.1 Legacy Module 15-SP5 (src): openvswitch-2.14.2-150400.24.17.1 SUSE Package Hub 15 15-SP4 (src): openvswitch-2.14.2-150400.24.17.1 SUSE Package Hub 15 15-SP5 (src): openvswitch-2.14.2-150400.24.17.1 Server Applications Module 15-SP4 (src): openvswitch-2.14.2-150400.24.17.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4657-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.5 (src): openvswitch3-3.1.0-150500.3.11.1 Server Applications Module 15-SP5 (src): openvswitch3-3.1.0-150500.3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4714-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1216002 CVE References: CVE-2023-5366 Sources used: openSUSE Leap 15.3 (src): openvswitch-2.14.2-150300.19.14.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): openvswitch-2.14.2-150300.19.14.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): openvswitch-2.14.2-150300.19.14.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): openvswitch-2.14.2-150300.19.14.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): openvswitch-2.14.2-150300.19.14.1 SUSE Enterprise Storage 7.1 (src): openvswitch-2.14.2-150300.19.14.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.