CVE-2023-5366

What it actually does

The flaw permits specially crafted ICMPv6 Neighbor Advertisement packets to bypass OpenFlow rules in Open vSwitch, allowing spoofed target IP addresses to redirect ICMPv6 traffic between virtual machines.

Why it matters to the business

Virtualized environments using affected Open vSwitch packages across Red Hat products and OpenShift may experience unauthorized traffic redirection, increasing risk of data exposure or disruption in multi-tenant setups with high ecosystem prevalence.

How an attack unfolds

A local attacker on a virtual machine crafts ICMPv6 Neighbor Advertisement packets with modified or spoofed target IP fields and transmits them to evade OpenFlow enforcement, resulting in redirection of ICMPv6 traffic to arbitrary addresses.

How to fix it

Upgrade Open vSwitch and dependent packages in Red Hat Enterprise Linux, OpenShift, Virtualization, and Fast Datapath to the latest patched releases that resolve the bypass condition; apply vendor updates as they become available.

How to confirm the fix worked

Confirm current Open vSwitch version against vendor advisories, review OpenFlow rule enforcement in test environments with crafted ICMPv6 packets, and validate that neighbor advertisement handling adheres to configured policies.

Typical attack path

1. Gain local access to a virtual machine on the affected Open vSwitch network
2. Construct ICMPv6 Neighbor Advertisement packets with spoofed target IP addresses
3. Transmit packets to trigger bypass of OpenFlow rules
4. Redirect subsequent ICMPv6 traffic to attacker-chosen destinations

How to detect it

Inspect Open vSwitch logs and packet captures for unexpected ICMPv6 Neighbor Advertisement packets containing anomalous target addresses; correlate with traffic flow changes that deviate from OpenFlow policies.

What your security team should do

• Prioritize patching Open vSwitch across all affected Red Hat platforms given widespread deployment
• Tighten OpenFlow rules to explicitly handle ICMPv6 neighbor discovery traffic
• Monitor EPSS trend and reassess if exploit maturity increases
• Segment virtual networks to limit local attacker reach