cbcvebase.
CVE-2018-17204
published 2018-09-19

CVE-2018-17204: An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group…

PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
1.91%
77.6th percentile
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.

Affected

13 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debianopenvswitch< openvswitch 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-1 (bookworm)openvswitch 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-1 (bookworm)
openvswitchopenvswitch>= 0 < 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12.10.0+2018.08.28+git.8ca7c82b7d+ds1-1
openvswitchopenvswitch>= 0 < 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12.10.0+2018.08.28+git.8ca7c82b7d+ds1-1
openvswitchopenvswitch>= 0 < 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12.10.0+2018.08.28+git.8ca7c82b7d+ds1-1
openvswitchopenvswitch>= 0 < 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12.10.0+2018.08.28+git.8ca7c82b7d+ds1-1
openvswitchopenvswitch>= 0 < 2.5.5-0ubuntu0.16.04.22.5.5-0ubuntu0.16.04.2
openvswitchopenvswitch>= 0 < 2.9.2-0ubuntu0.18.04.32.9.2-0ubuntu0.18.04.3
openvswitchopenvswitch2.7.0 – 2.7.6
redhatopenstack
redhatopenstack

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.