Openvswitch don't match packets on nd_target field

Summary

A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.

Timeline

1. Oct 6, 2023, 5:43 PM UTCCVE published
2. Feb 13, 2025, 5:20 PM UTCRecord last updated

Affected versions

• n/a openvswitch

  Version range not reported

• openvswitch

  Version range not reported

• openvswitch2.10

  Version range not reported

• openvswitch2.11

  Version range not reported

• openvswitch2.12

  Version range not reported

• openvswitch2.13

  Version range not reported

• openvswitch2.15

  Version range not reported

• openvswitch2.11

  Version range not reported

• openvswitch2.12

  Version range not reported

• openvswitch2.13

  Version range not reported

• openvswitch2.15

  Version range not reported

• openvswitch2.16

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.1

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.0

  Version range not reported

• openvswitch3.1

  Version range not reported

• openvswitch

  Version range not reported

• openvswitch-ovn-kubernetes

  Version range not reported

• openvswitch2.15

  Version range not reported

• openvswitch2.16

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.0

  Version range not reported

• openvswitch3.1

  Version range not reported

• rhosp-openvswitch

  Version range not reported

• rhosp-openvswitch

  Version range not reported

• openvswitch2.11

  Version range not reported

• redhat-virtualization-host

  Version range not reported

• openvswitch

  Version range not reported

References 6