Ovn: insufficient validation of bfd packets may lead to denial of service
CVE-2024-2182

6.5MEDIUM

Key Information:

Vendor
Red Hat
Status
Fast Datapath For Red Hat Enterprise Linux 8
Fast Datapath For Red Hat Enterprise Linux 9
Fast Datapath For Rhel 7
Fast Datapath For Rhel 8
Vendor
CVE Published:
12 March 2024

Summary

A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a denial of service.

Affected Version(s)

Fast Datapath for Red Hat Enterprise Linux 8 0:23.06.1-112.el8fdp

Fast Datapath for Red Hat Enterprise Linux 8 0:22.12.1-94.el8fdp

Fast Datapath for Red Hat Enterprise Linux 8 0:22.03.3-71.el8fdp

References

http://www.openwall.com/lists/oss-security/2024/03/12/5
https://access.redhat.com/errata/RHSA-2024:1385
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:1386
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Red Hat would like to thank Frode Nordahl (Canonical) for reporting this issue.
.