Critical Open vSwitch Vulnerability: ICMPv6 Traffic Redirection Risk
Summary
USN-6514-1: openvswitch vulnerability. Affects openvswitch versions < 2.9.8-0ubuntu0.18.04.5+esm1. Fixed in 2.9.8-0ubuntu0.18.04.5+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open vSwitch is a production-quality, multilayer virtual switch designed to enable network automation while supporting standard management interfaces and protocols. It is widely used in cloud computing environments to manage network traffic. The recent vulnerability discovered in Open vSwitch pertains to its handling of OpenFlow rules for ICMPv6 Neighbor Advertisement packets, which could allow local attackers to redirect traffic to arbitrary IP addresses.
Vulnerability Detail
The vulnerability, identified as CVE-2023-5366, arises from Open vSwitch's improper handling of ICMPv6 Neighbor Advertisement packets. This flaw can be exploited by a local attacker to manipulate network traffic, potentially redirecting it to unintended destinations. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive data or disruption of network services.
How To Fix
Minimum fixed version
2.9.8-0ubuntu0.18.04.5+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvswitchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Open vSwitch service to trusted users only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
The Open vSwitch vulnerability identified as CVE-2023-5366 poses a significant risk by allowing local attackers to redirect network traffic. It is crucial for users to update their packages to the patched versions provided by Ubuntu to mitigate this risk. Additionally, implementing temporary workarounds can help protect systems until updates are applied.
See every vulnerability recorded for openvswitch →
FAQ
The vulnerability allows local attackers to redirect network traffic by exploiting improper handling of ICMPv6 Neighbor Advertisement packets.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data and disruption of network services.
Yes, patched versions of Open vSwitch are available for both Ubuntu 20.04 LTS and Ubuntu Pro (Infra-only).
As a workaround, restrict access to the Open vSwitch service to trusted users to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openvswitch.
