CVE-2023-3966

What it actually does

Crafted Geneve packets processed with hardware offloading enabled via the netlink path trigger invalid memory accesses in Open vSwitch, resulting in denial of service.

Why it matters to the business

Network virtualization and overlay services using Open vSwitch with Geneve offload can experience sudden outages or instability, affecting connectivity for dependent applications and workloads.

How an attack unfolds

An attacker sends specially crafted Geneve packets to a vulnerable Open vSwitch instance that has hardware offloading enabled through the netlink interface, causing the switch to perform invalid memory operations and crash.

How to fix it

Upgrade Open vSwitch to the fixed commit 3c2bea086ef8912d57331173af266f21d36740a0 or later. Disable hardware offloading via netlink as a temporary mitigation if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the running Open vSwitch binary or source matches the fixed commit hash; test packet processing with Geneve offload enabled using controlled malformed packets to confirm absence of crashes.

Typical attack path

1. Identify Open vSwitch deployments with Geneve hardware offloading enabled via netlink
2. Craft and transmit malicious Geneve packets from a remote network position
3. Trigger invalid memory access leading to process crash or service denial

How to detect it

Review Open vSwitch logs and system crash reports for segmentation faults or memory access violations during Geneve packet handling; correlate with netlink offload configuration changes.

What your security team should do

• Apply the fix to commit 3c2bea086ef8912d57331173af266f21d36740a0 on all affected instances immediately
• Audit configurations for netlink-based hardware offloading and disable where not required
• Monitor upstream releases for any additional related fixes in the Geneve datapath