CVE-2023-5366highCWE-345

CVE-2023-5366: fallo de gravedad alta en openvswitch

Openvswitch don't match packets on nd_target field

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Enterprise Linux+ Monitorear Red Hat OpenShift Container Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Productos afectados
Fedora · Fedoran/a · openvswitchRed Hat · Fast Datapath for RHEL 7Red Hat · Fast Datapath for RHEL 8Red Hat · Fast Datapath for RHEL 9Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat OpenShift Container Platform 3.11Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenStack Platform 16.1Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat Virtualization 4
CVEs relacionadas — openvswitch

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.9%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.5%CVE-2023-6246HIGHGlibc: heap-based buffer overflow in __vsyslog_internal()EPSS 4.8%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%