net: openvswitch: fix leak of nested actions
Summary
GSD-2022-1001685: net: openvswitch: fix leak of nested actions. Affects Kernel versions >= 34ae932a40369be6bd6ea97d66b6686361b4370d, < 837b96d8103938e35e7d92cd9db96af914ca4fff. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net: openvswitch package is a part of the Linux Kernel ecosystem. It provides support for the Open vSwitch (OVS) virtual switch, which is a multi-layer software switch that enables network automation and virtualization. OVS allows for the creation of virtual networks and the implementation of network policies. This vulnerability affects the net: openvswitch package and can lead to a leak of nested actions.
Vulnerability Detail
The vulnerability in net: openvswitch involves a leak of nested actions. The specific origin of the vulnerability is not mentioned in the provided information. However, it is stated that the impact and attack plausibility have not yet been proven. The vulnerability was introduced in version v4.3 of the Linux Kernel by commit 34ae932a40369be6bd6ea97d66b6686361b4370d. It has been fixed in version v5.15.34 by commit 837b96d8103938e35e7d92cd9db96af914ca4fff. Further technical details and potential ramifications of the vulnerability are not provided.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The net: openvswitch package in the Linux Kernel is vulnerable to a leak of nested actions. The specific impact and attack plausibility of the vulnerability have not been proven. To fix the vulnerability, it is recommended to update the Linux Kernel to version v5.15.34 or later. No workaround is mentioned in the provided information. For more information and support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Net: openvswitch is a package in the Linux Kernel ecosystem that provides support for the Open vSwitch (OVS) virtual switch. OVS enables network automation and virtualization, allowing for the creation of virtual networks and implementation of network policies.
The impact of the vulnerability is not specified in the provided information. However, it is mentioned that the actual impact and attack plausibility have not yet been proven.
To fix the vulnerability, it is recommended to update the Linux Kernel to version v5.15.34 or later. This update includes the necessary fix for the net: openvswitch package.
No workaround is mentioned in the provided information.
For more information about the vulnerability, you can refer to the source link in the provided information: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001685.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
