Ovn: ovn: heap over-read in icmp error response generation

Summary

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Timeline

1. Apr 24, 2026, 12:25 PM UTCCVE published
2. Apr 24, 2026, 6:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 17, 2026, 10:00 PM UTCRecord last updated

Affected versions

• ovn25.03

  Version range not reported

• ovn25.09

  Version range not reported

• ovn-2021

  Version range not reported

• ovn23.06

  Version range not reported

• ovn23.06

  Version range not reported

• ovn23.09

  Version range not reported

• ovn24.03

  Version range not reported

• ovn25.03

  Version range not reported

• ovn25.09

  Version range not reported

• ovn2.11

  Version range not reported

• ovn2.12

  Version range not reported

• ovn2.13

  Version range not reported

• ovn2.11

  Version range not reported

• ovn2.12

  Version range not reported

• ovn2.13

  Version range not reported

• ovn22.03

  Version range not reported

• ovn22.06

  Version range not reported

• ovn22.09

  Version range not reported

• ovn22.12

  Version range not reported

• ovn23.03

  Version range not reported

• ovn-2021

  Version range not reported

• ovn22.03

  Version range not reported

• ovn22.06

  Version range not reported

• ovn22.09

  Version range not reported

• ovn22.12

  Version range not reported

• ovn23.03

  Version range not reported

• ovn24.09

  Version range not reported

References 11