Headline
Ubuntu Security Notice USN-6514-1
Ubuntu Security Notice 6514-1 - It was discovered that Open vSwitch did not correctly handle OpenFlow rules for ICMPv6 Neighbour Advertisement packets. A local attacker could possibly use this issue to redirect traffic to arbitrary IP addresses.
==========================================================================
Ubuntu Security Notice USN-6514-1
November 26, 2023
openvswitch vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Open vSwitch could be made to expose sensitive information over the
network.
Software Description:
- openvswitch: Ethernet virtual switch
Details:
It was discovered that Open vSwitch did not correctly handle OpenFlow
rules for ICMPv6 Neighbour Advertisement packets. A local attacker could
possibly use this issue to redirect traffic to arbitrary IP addresses.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
openvswitch-common 2.13.8-0ubuntu1.3
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openvswitch-common 2.9.8-0ubuntu0.18.04.5+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6514-1
CVE-2023-5366
Package Information:
https://launchpad.net/ubuntu/+source/openvswitch/2.13.8-0ubuntu1.3
Related news
Debian Linux Security Advisory 5640-1 - Two vulnerabilities were discovered in Open vSwitch, a software-based Ethernet virtual switch, which could result in a bypass of OpenFlow rules or denial of service.
Ubuntu Security Notice 6690-1 - Timothy Redaelli and Haresh Khandelwal discovered that Open vSwitch incorrectly handled certain crafted Geneve packets when hardware offloading via the netlink path is enabled. A remote attacker could possibly use this issue to cause Open vSwitch to crash, leading to a denial of service. It was discovered that Open vSwitch incorrectly handled certain ICMPv6 Neighbor Advertisement packets. A remote attacker could possibly use this issue to redirect traffic to arbitrary IP addresses.
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.