Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in…
Priority LOW 27CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0118 67th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* | 2.11.0 – 2.15.0 | Vulnerable | Openvswitch |
- cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* Versions 2.11.0 – 2.15.0 Vulnerable ·Openvswitch
Remediation
Red Hat 2 advisories
- RHSA-2021:3942 Released 2021-10-20 · Red Hat rating Moderateopenvswitch2.11 security update
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts openvswitch2.11-2.11.3-89.el7fdp, openvswitch2.11-devel-2.11.3-89.el7fdp, python-openvswitch2.11-2.11.3-89.el7fdp
- RHSA-2021:3758 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 packages and security update
- Red Hat OpenShift Container Platform 4.9 coreos-installer-0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra-0.10.0-2.rhaos4.9.el8, jenkins-2.289.3.1630554997-1.el8 +10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fast Datapath for RHEL 7 | Affected | No fix planned: Will not fix |
| Fast Datapath for RHEL 8 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Fast Datapath for Red Hat Enterprise Linux 7 | Fixed | — |
| Fast Datapath for Red Hat Enterprise Linux 8 | Fixed | — |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3758 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2021:3942 |
Not affected: 6 products
- Fast Datapath for RHEL 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36980
- 2026-10-03 Alias added: GHSA-ww48-mfpv-wc3r
References
Patch 7
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851
- https://github.com/openvswitch/ovs/commit/77cccc74deede443e8b9102299efc869a52b65b2
- https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115300f58f
- https://github.com/openvswitch/ovs/commit/65c61b0c23a0d474696d7b1cea522a5016a8aeb3
- https://github.com/openvswitch/ovs/commit/6d67310f4d2524b466b98f05ebccc1add1e8cf35
- https://github.com/openvswitch/ovs/commit/8ce8dc34b5f73b30ce0c1869af9947013c3c6575
- https://github.com/openvswitch/ovs/commit/9926637a80d0d243dbf9c49761046895e9d1a8e2
More Openvswitch vulnerabilities
- TI-2024-15067 openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c. CVSS 3.1HIGH 7.5
- TI-2016-01905 Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before… CVSS 3.0CRITICAL 9.8
- TI-2020-18020 Uncontrolled resource consumption in openvswitch CVSS 3.1HIGH 7.5
- TI-2017-06707 In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod… CVSS 3.0CRITICAL 9.8
- TI-2017-06706 In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a… CVSS 3.0CRITICAL 9.8
- TI-2017-06664 In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-36980 · CVE Program
- CVE-2021-36980 · NVD
- FIRST EPSS
- GHSA-ww48-mfpv-wc3r · GitHub Advisory Database · CC BY 4.0
- CVE-2021-36980 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences