A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

An update of the openvswitch package has been released.

The remote host is affected by the vulnerability described in GLSA-202311-16 (Open vSwitch: Multiple Vulnerabilities)

  - A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to     be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

  - A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker     could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
    (CVE-2021-3905)

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

  - An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4337)

  - An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4338)

  - A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the     datapath flow without the action modifying the IP header. This issue results (for both kernel and     userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for     this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a !=     0 IP protocol that matches this dp flow. (CVE-2023-1668)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3384-1 advisory.

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2456 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * limitation in the OVS packet parsing in userspace leads to DoS     (CVE-2020-35498)

    * denial of service via externally triggered memory leak (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2077 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c     (CVE-2015-8011)

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS     (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak     (CVE-2020-27827)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Citrix Hypervisor (formerly Citrix XenServer) running on the remote host is missing a security hotfix. It is, therefore, affected by denial of service vulnerabilities. 

 - A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service    attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for    mitigating factors. (CVE-2021-28038)    
 - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a    malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide,    potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
   (CVE-2020-35498)  
 - A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service    attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for    mitigating factors. (CVE-2021-28688)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1050 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0834 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0837 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS     (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak     (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0835 advisory.

    Open vSwitch provides standard network bridging functions and support for     the OpenFlow protocol for remote per-flow control of traffic.

    Security Fix(es):

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-fba11d37ee advisory.

  - Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote     attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors     involving large management addresses and TLV boundaries. (CVE-2015-8011)

  - A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to     be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several issues have been found in openvswitch, a production quality, multilayer, software-based, Ethernet virtual switch.

CVE-2020-35498

Denial of service attacks, in which crafted network packets could cause the packet lookup to ignore network header fields from layers 3 and 4. The crafted network packet is an ordinary IPv4 or IPv6 packet with Ethernet padding length above 255 bytes. This causes the packet sanity check to abort parsing header fields after layer 2.

CVE-2020-27827

Denial of service attacks using crafted LLDP packets.

CVE-2018-17206

Buffer over-read issue during BUNDLE action decoding.

CVE-2018-17204

Assertion failure due to not validating information (group type and command) in OF1.5 decoder.

CVE-2017-9214

Buffer over-read that is caused by an unsigned integer underflow.

CVE-2015-8011

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

For Debian 9 stretch, these problems have been fixed in version 2.6.10-0+deb9u1. This version is a new upstream point release.

We recommend that you upgrade your openvswitch packages.

For the detailed security status of openvswitch please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openvswitch

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet.

This update for openvswitch fixes the following issues :

CVE-2020-35498: Fixed a denial of service related to the handling of Ethernet padding (bsc#1181742).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvswitch fixes the following issues :

  - CVE-2020-35498: Fixed a denial of service related to the     handling of Ethernet padding (bsc#1181742).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0497 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * openvswitch: limitation in the OVS packet parsing in userspace leads to DoS (CVE-2020-35498)

    * lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [RFE] Add auto load balance params (BZ#1920121)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4729-1 advisory.

    Joakim Hindersson discovered that Open vSwitch incorrectly parsed certain network packets. A remote     attacker could use this issue to cause a denial of service, or possibly alter packet classification.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203113	Photon OS 2.0: Openvswitch PHSA-2021-2.0-0323	Nessus	PhotonOS Local Security Checks	high
186285	GLSA-202311-16 : Open vSwitch: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
165482	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2022:3384-1)	Nessus	SuSE Local Security Checks	high
150844	RHEL 7 : Red Hat OpenStack Platform 13.0 (openvswitch2.11) (RHSA-2021:2456)	Nessus	Red Hat Local Security Checks	high
149839	RHEL 7 : openvswitch (RHSA-2021:2077)	Nessus	Red Hat Local Security Checks	critical
148674	Citrix Hypervisor <= 8.2 LTSR DoS (CTX306565)	Nessus	Misc.	high
148257	RHEL 7 : openvswitch2.11 (RHSA-2021:1050)	Nessus	Red Hat Local Security Checks	high
148025	Photon OS 4.0: Openvswitch PHSA-2021-4.0-0001	Nessus	PhotonOS Local Security Checks	high
147810	RHEL 7 : openvswitch2.11 (RHSA-2021:0834)	Nessus	Red Hat Local Security Checks	high
147807	RHEL 8 : openvswitch2.11 (RHSA-2021:0837)	Nessus	Red Hat Local Security Checks	high
147806	RHEL 7 : openvswitch2.13 (RHSA-2021:0835)	Nessus	Red Hat Local Security Checks	high
147151	Fedora 33 : 2:dpdk / openvswitch (2021-fba11d37ee)	Nessus	Fedora Local Security Checks	critical
147006	Photon OS 1.0: Openvswitch PHSA-2021-1.0-0366	Nessus	PhotonOS Local Security Checks	high
146995	Photon OS 3.0: Openvswitch PHSA-2021-3.0-0202	Nessus	PhotonOS Local Security Checks	high
146677	Debian DLA-2571-1 : openvswitch security update	Nessus	Debian Local Security Checks	critical
146561	Debian DSA-4852-1 : openvswitch - security update	Nessus	Debian Local Security Checks	high
146530	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2021:0479-1)	Nessus	SuSE Local Security Checks	high
146526	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2021:0451-1)	Nessus	SuSE Local Security Checks	high
146520	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2021:0446-1)	Nessus	SuSE Local Security Checks	high
146507	openSUSE Security Update : openvswitch (openSUSE-2021-283)	Nessus	SuSE Local Security Checks	high
146478	SUSE SLED15 / SLES15 Security Update : openvswitch (SUSE-SU-2021:0436-1)	Nessus	SuSE Local Security Checks	high
146475	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2021:0440-1)	Nessus	SuSE Local Security Checks	high
146465	SUSE SLED15 / SLES15 Security Update : openvswitch (SUSE-SU-2021:0439-1)	Nessus	SuSE Local Security Checks	high
146439	RHEL 8 : openvswitch2.13 (RHSA-2021:0497)	Nessus	Red Hat Local Security Checks	high
146375	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Open vSwitch vulnerability (USN-4729-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-35498

high

Tenable Plugins

high

critical

high

high

critical

high

high

high

high

high

high

critical

high

high

critical

high

high

high

high

high

high

high

high

high

high