Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet
Priority MEDIUM 41CWE-248Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-248.
Summary
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01252 69th percentileScored 2026-11-07
Fix Partial openvswitch: 3.1.0Red Hat: 3 advisoriesRed Hat: 2 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openvswitch | — | 3.1.0 | Patch available | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — | Not affected | CNA |
| RDO | OpenStack RDO | — | — | No fix listed | CNA |
| Fedora | Fedora | — | — | No fix listed | CNA |
- openvswitch Vendor— Affected — Fixed in 3.1.0 Patch available CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 3.11 VendorRed Hat Affected — Fixed in — Not affected CNA
- OpenStack RDO VendorRDO Affected — Fixed in — No fix listed CNA
- Fedora VendorFedora Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* | before 3.1.0 | Vulnerable | Openvswitch |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* Versions before 3.1.0 Vulnerable ·Openvswitch
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA openvswitch Fixed in 3.1.0
Red Hat 3 advisories
- RHSA-2024:1227 Released 2024-03-07 · Red Hat rating Importantopenvswitch3.1 security update
- Fast Datapath for Red Hat Enterprise Linux 9 openvswitch3.1-3.1.0-88.el9fdp, openvswitch3.1-devel-3.1.0-88.el9fdp, openvswitch3.1-ipsec-3.1.0-88.el9fdp +2
- RHSA-2024:1235 Released 2024-03-07 · Red Hat rating Importantopenvswitch3.1 security update
- Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch3.1-3.1.0-96.el8fdp, openvswitch3.1-3.1.0-96.el8fdp, openvswitch3.1-devel-3.1.0-96.el8fdp +3
- RHSA-2024:1234 Released 2024-03-07 · Red Hat rating Importantopenvswitch2.17 security update
- Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.17-2.17.0-148.el8fdp, openvswitch2.17-2.17.0-148.el8fdp, openvswitch2.17-devel-2.17.0-148.el8fdp +3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fast Datapath for RHEL 7 | Affected | No fix planned: Out of support scope |
| Fast Datapath for RHEL 8 | Affected | No fix planned: Out of support scope |
| Fast Datapath for RHEL 9 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Fast Datapath for Red Hat Enterprise Linux 8 | Fixed | RHSA-2024:1234, RHSA-2024:1235 |
| Fast Datapath for Red Hat Enterprise Linux 9 | Fixed | RHSA-2024:1227 |
Not affected: 1 product
- Red Hat OpenShift Container Platform 3.11
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3966
- 2026-10-03 Alias added: GHSA-r9cj-pfgj-jc26
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-3966 · CVE Program
- CVE-2023-3966 · NVD
- FIRST EPSS
- GHSA-r9cj-pfgj-jc26 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-3966 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences