When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

libopenvswitch-3_7-0-3.7.1-34.1 on GA media

ovn: ovn: Heap Over-Read in ICMP Error Response Generation ovn: OVN: Information disclosure via crafted DHCPv6 packets

Security update for openvswitch

Affected: Ubuntu:20.04:LTS: ovn, Ubuntu:22.04:LTS: ovn, Ubuntu:24.04:LTS: ovn, Ubuntu:25.10: ovn, Ubuntu:26.04:LTS: ovn

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Fast Datapath für Red Hat Enterprise Linuxausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.