CVE-2023-5366 Openvswitch don't match packets on nd_target field
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
Problem types: cwe_id: CWE-345
description: Insufficient Verification of Data Authenticity
Affected products: vendor: n/a
product: openvswitch
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: unknown
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 3.11
cpes: cpe:/a:redhat:openshift:3.11
default_status: unknown
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unknown
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.1
cpes: cpe:/a:redhat:openstack:16.1
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
cpes: cpe:/a:redhat:openstack:16.2
default_status: unaffected
vendor: Red Hat
product: Red Hat Virtualization 4
cpes: cpe:/:redhat:enterprise_linux:::hypervisor
default_status: affected
vendor: Red Hat
product: Red Hat Virtualization 4
cpes: cpe:/:redhat:enterprise_linux:::hypervisor
default_status: affected
vendor: Fedora
product: Fedora
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Alex Katz (Red Hat) and Slawomir Kaplonski (Red Hat).
Published: 2023-10-06T17:43:34.376Z