Ubuntu.comUB:CVE-2023-3966CVE-2023-3966
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
15.5%
A flaw was found in Open vSwitch where multiple versions are vulnerable to
crafted Geneve packets, which may result in a denial of service and invalid
memory accesses. Triggering this issue requires that hardware offloading
via the netlink path is enabled.
Bugs
Notes
| Author | Note |
|---|---|
| amurray | According to the upstream advisory only affects version 2.12 and newer but the mentioned commit which introduced this bug (https://github.com/openvswitch/ovs/commit/a468645c6d33) was shipped in 2.11.0 as well so assuming this is also affected. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 20.04 | noarch | openvswitch | < 2.13.8-0ubuntu1.4 | UNKNOWN |
| ubuntu | 22.04 | noarch | openvswitch | < 2.17.9-0ubuntu0.22.04.1 | UNKNOWN |
| ubuntu | 23.10 | noarch | openvswitch | < 3.2.2-0ubuntu0.23.10.1 | UNKNOWN |
| ubuntu | 24.04 | noarch | openvswitch | < 3.3.0~git20240118.e802fe7-3ubuntu1 | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2023-3966
mail.openvswitch.org/pipermail/ovs-dev/2024-February/411702.html
nvd.nist.gov/vuln/detail/CVE-2023-3966
security-tracker.debian.org/tracker/CVE-2023-3966
ubuntu.com/security/notices/USN-6690-1
www.cve.org/CVERecord?id=CVE-2023-3966
www.openwall.com/lists/oss-security/2024/02/08/3
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
15.5%