{"id":"CVE-2023-5366","state":"PUBLISHED","title":"Openvswitch don't match packets on nd_target field","description":"A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.","publishedAt":"2023-10-06T17:43:34.376Z","updatedAt":"2025-02-13T17:20:09.786Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a openvswitch","Red Hat Fast Datapath for RHEL 7","Red Hat Fast Datapath for RHEL 8","Red Hat Fast Datapath for RHEL 9","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat OpenShift Container Platform 3.11","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat OpenStack Platform 16.1","Red Hat Red Hat OpenStack Platform 16.2","Red Hat Red Hat Virtualization 4","Fedora Fedora"],"affected":[{"vendor":"n/a","product":"openvswitch","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.10","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.11","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.12","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 3.11","packageName":"openvswitch-ovn-kubernetes","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:3.11"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.15","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.1","packageName":"rhosp-openvswitch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","packageName":"rhosp-openvswitch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/:redhat:enterprise_linux:::hypervisor"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4","packageName":"redhat-virtualization-host","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/:redhat:enterprise_linux:::hypervisor"]},{"vendor":"Fedora","product":"Fedora","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2023-5366","https://bugzilla.redhat.com/show_bug.cgi?id=2006347","http://www.openwall.com/lists/oss-security/2024/02/08/4","https://lists.debian.org/debian-lts-announce/2024/02/msg00004.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/"],"weaknesses":["CWE-345"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5366.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5366","state":"PUBLISHED","datePublished":"2023-10-06T17:43:34.376Z","dateUpdated":"2025-02-13T17:20:09.786Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-10-03T19:14:58.793Z"},"containers":{"cna":{"title":"Openvswitch don't match packets on nd_target field","descriptions":[{"lang":"en","value":"A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses."}],"affected":[{"vendor":"n/a","product":"openvswitch","defaultStatus":"affected"},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.10","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.11","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.12","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 7","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 3.11","packageName":"openvswitch-ovn-kubernetes","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:3.11"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.15","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.1","packageName":"rhosp-openvswitch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","packageName":"rhosp-openvswitch","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/:redhat:enterprise_linux:::hypervisor"]},{"vendor":"Red Hat","product":"Red Hat Virtualization 4","packageName":"redhat-virtualization-host","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/:redhat:enterprise_linux:::hypervisor"]},{"vendor":"Fedora","product":"Fedora","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-5366","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006347","name":"RHBZ#2006347","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/08/4"},{"url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00004.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","description":"Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-03-23T02:06:38.589Z"},"datePublic":"2023-09-26T00:00:00.000Z","x_redhatCweChain":"CWE-345: Insufficient Verification of Data Authenticity","timeline":[{"lang":"en","time":"2021-09-21T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-09-26T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Alex Katz (Red Hat) and Slawomir Kaplonski (Red Hat)."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-5366","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006347","name":"RHBZ#2006347","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/08/4","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00004.html","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:59:43.267Z"}}]}}}