CVE-2022-2639

What it actually does

Integer coercion error in reserve_sfa_size() within the openvswitch kernel module fails to return -EMSGSIZE for large action counts during flow memory reservation, enabling out-of-bounds write access.

Why it matters to the business

Local attackers on affected Linux systems can crash hosts or escalate privileges, disrupting network operations and potentially compromising kernel-level control on systems using openvswitch.

How an attack unfolds

A local user crafts a flow with a large number of actions and installs it via openvswitch interfaces; the flawed reserve_sfa_size() function performs an out-of-bounds write during memory copying, allowing crash or privilege escalation. Exploit code is publicly available.

How to fix it

Apply the upstream Linux kernel fix at commit b562e44f507e863c6792946e4e1b1449fbbac85d in the openvswitch module; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm presence of commit b562e44f507e863c6792946e4e1b1449fbbac85d in the running kernel source or package; attempt safe reproduction of large-action flows in a test environment and verify no out-of-bounds behavior occurs.

Typical attack path

1. Obtain local shell or process access on a Linux host running openvswitch
2. Construct and submit a flow with an excessive number of actions through the openvswitch netlink interface
3. Trigger reserve_sfa_size() memory reservation path
4. Leverage the resulting out-of-bounds write for denial of service or kernel code execution

How to detect it

Review kernel logs for openvswitch oops or panic messages involving memory writes; inspect audit logs for unusual netlink activity installing flows with high action counts.

What your security team should do

• Immediately update all Linux kernels using openvswitch to the fixed commit
• Limit local user privileges on systems exposing openvswitch interfaces
• Monitor kernel logs for openvswitch-related memory faults until patches are applied