ID

VAR-202102-0421

CVE

CVE-2020-35498

TITLE

Openvswitch Resource Management Error Vulnerability

DESCRIPTION

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability. Bug Fix(es): * [RFE] Add auto load balance params (BZ#1920121) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openvswitch2.11 security update Advisory ID: RHSA-2021:1050-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2021:1050 Issue date: 2021-03-31 CVE Names: CVE-2020-27827 CVE-2020-35498 ==================================================================== 1. Summary: An update for openvswitch2.11 is now available in Red Hat Virtualization. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts - ppc64le, x86_64 3. Description: Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fix(es): * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS (CVE-2020-35498) * lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/2974891 5. Package List: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts: Source: openvswitch2.11-2.11.3-86.el7fdp.src.rpm ovn2.11-2.11.1-57.el7fdp.src.rpm ppc64le: openvswitch2.11-2.11.3-86.el7fdp.ppc64le.rpm openvswitch2.11-debuginfo-2.11.3-86.el7fdp.ppc64le.rpm openvswitch2.11-devel-2.11.3-86.el7fdp.ppc64le.rpm ovn2.11-2.11.1-57.el7fdp.ppc64le.rpm ovn2.11-debuginfo-2.11.1-57.el7fdp.ppc64le.rpm ovn2.11-host-2.11.1-57.el7fdp.ppc64le.rpm ovn2.11-vtep-2.11.1-57.el7fdp.ppc64le.rpm python-openvswitch2.11-2.11.3-86.el7fdp.ppc64le.rpm x86_64: openvswitch2.11-2.11.3-86.el7fdp.x86_64.rpm openvswitch2.11-debuginfo-2.11.3-86.el7fdp.x86_64.rpm openvswitch2.11-devel-2.11.3-86.el7fdp.x86_64.rpm ovn2.11-2.11.1-57.el7fdp.x86_64.rpm ovn2.11-debuginfo-2.11.1-57.el7fdp.x86_64.rpm ovn2.11-host-2.11.1-57.el7fdp.x86_64.rpm ovn2.11-vtep-2.11.1-57.el7fdp.x86_64.rpm python-openvswitch2.11-2.11.3-86.el7fdp.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-27827 https://access.redhat.com/security/cve/CVE-2020-35498 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYGRyQ9zjgjWX9erEAQhrShAAoeVmG1YdiiU+KFMdloJYVujUHAfasBEU Lh4XW/2T4R+kLbrG+cNu6Whm5JrNMNHxcr7VCBzBxMH2BdmhbBc+UhxEVIAmq9Kd BvOQykUW++052BkY4Iqm7q9viXkZNR4SK9fN2PKwK2yPezslta+AMQfnRhNzHU2a zv2uMt+198ALo/NriH4E5MFX4L8J7gvI+w1M6WsTXET9PJ3okANav+3E6gtwgheq gC0B3z7pzBDlSCIGXAi4lZjjtOd+jrZaxie6ltuQ0GPvEBLZXr+w8g9Q9SFhoBLE nN2UuWzhAq66rFPCan5YHn41AUNtwvfu5MAWOwk3KDFXznS9exXsBBQjN25y4jcO xl8cFSkJRghyJE1V5N2F52I9rTtqCysOyyLhoMWuNcYn7oU+rcQ/WAonrheYtZqk t+iRwOf04o9Zt9ns9Q5iHG5aQwXq0rB+HAeGfb0+4izqUF43HWj2pyxtaPq2jQfa iph0VN0x2M4ENXpjtO8vctu8Q1SKk0exiIou2d1EI0Dt4INZs67ewJyi1XoZP8Uu xRUWSPDMaWHKYCXzBkVD6nJQNmLT2usb4rfc3SkqG1Wjr2ieiiQC6k1Z/wi+RKfW lRK6WqHZTaAf0mG3QIjqmXa1IbF9CcGzoCtpfitPiWL0l2aewVSiDjXRsCVBorkX O5fT6yRvUC8=XI93 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-4729-1 February 10, 2021 openvswitch vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Open vSwitch could be made to crash or perform unexpectedly if it received specially crafted network traffic. Software Description: - openvswitch: Ethernet virtual switch Details: Joakim Hindersson discovered that Open vSwitch incorrectly parsed certain network packets. A remote attacker could use this issue to cause a denial of service, or possibly alter packet classification. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.10: openvswitch-common 2.13.1-0ubuntu1.3 Ubuntu 20.04 LTS: openvswitch-common 2.13.1-0ubuntu0.20.04.4 Ubuntu 18.04 LTS: openvswitch-common 2.9.8-0ubuntu0.18.04.2 Ubuntu 16.04 LTS: openvswitch-common 2.5.9-0ubuntu0.16.04.3 In general, a standard system update will make all the necessary changes. For the stable distribution (buster), this problem has been fixed in version 2.10.7+ds1-0+deb10u1. We recommend that you upgrade your openvswitch packages. For the detailed security status of openvswitch please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openvswitch Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmAqZqIACgkQEL6Jg/PV nWSxAwf9Fs4AJekINCdGzSqrz3bBP3hpZj5otk9mVDcW6UC2yNcz+BUyxg81YB3m 0Fc8KGCaxp7bm5B3o/j8vzhs9JSBXdI9qZr72/5W7nWL5zqUdtptv4On4bChPq+6 MFn5Akaekkx/Fz25i33J859LHmn/8h9FXk/ADLRUdz+/iMintWG9mne39OXk8D3C 8Tp1zESGtitNbbq8YH7c4DsXA2kercBb22AqcE+2HClCaCGYaFi+xkLxwMpfbIVg E0WjhmeqWFZuLzRAwnKlL+MaQT19IlDMump95VZbJ7wzp4I0FSgWsAJ0JpFPu5xX btwIDA8LaoeZ7tnjYfQ/0bpx8dV9bA== =mPSj -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202311-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Open vSwitch: Multiple Vulnerabilities Date: November 26, 2023 Bugs: #765346, #769995, #803107, #887561 ID: 202311-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple denial of service vulnerabilites have been found in Open vSwitch. Background ========= Open vSwitch is a production quality multilayer virtual switch. Affected packages ================ Package Vulnerable Unaffected -------------------- ------------ ------------ net-misc/openvswitch < 2.17.6 >= 2.17.6 Description ========== Multiple vulnerabilities have been discovered in Open vSwitch. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Open vSwitch users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openvswitch-2.17.6" References ========= [ 1 ] CVE-2020-27827 https://nvd.nist.gov/vuln/detail/CVE-2020-27827 [ 2 ] CVE-2020-35498 https://nvd.nist.gov/vuln/detail/CVE-2020-35498 [ 3 ] CVE-2021-3905 https://nvd.nist.gov/vuln/detail/CVE-2021-3905 [ 4 ] CVE-2021-36980 https://nvd.nist.gov/vuln/detail/CVE-2021-36980 [ 5 ] CVE-2022-4337 https://nvd.nist.gov/vuln/detail/CVE-2022-4337 [ 6 ] CVE-2022-4338 https://nvd.nist.gov/vuln/detail/CVE-2022-4338 [ 7 ] CVE-2023-1668 https://nvd.nist.gov/vuln/detail/CVE-2023-1668 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202311-16 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2023 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2024-09-17T21:14:02.926000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE