CVE-2023-1668

State: Published
Severity: 8.2 High
Published: Apr 10, 2023
Updated: Apr 23, 2025
Reserved: Mar 27, 2023

Description

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	CISA-ADP

Weaknesses

CWE-670

Affected Products

Product	Versions
openvswitchn/a	unknownAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=2137666
https://www.openwall.com/lists/oss-security/2023/04/06/1
DSA-5387vendor-advisory
FEDORA-2023-7da03dc2aevendor-advisory
[debian-lts-announce] 20230501 [SECURITY] [DLA 3410-1] openvswitch security updatemailing-list
GLSA-202311-16vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.