CVE-2024-2182
Medium · 6.5CVSS
6.5
EPSS
0.8%
Published
Mar 12, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
Attackers inside virtual machines can send fake network messages that crash the system responsible for keeping the virtual network running smoothly.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Denial of service
- Remediation
- Other
- Effort
- Other
- Patch risk
- Other
What it actually does
Allows unprivileged workloads to inject crafted BFD packets that disrupt OVN's high-availability mechanisms between hypervisors, resulting in denial of service.
Why it matters to the business
Network connectivity and high-availability features in virtualized environments can be taken offline, causing outages for applications and services that rely on the overlay network.
How an attack unfolds
An attacker running inside a virtual machine or container on the same cluster sends specially crafted BFD packets targeting the BFD sessions used by OVN hypervisors for high availability, causing the OVN control plane to fail and triggering a denial of service.
How to fix it
Upgrade OVN to a version that properly validates BFD packets from untrusted sources and restricts processing of BFD traffic originating from workloads. Apply network segmentation or firewall rules to prevent workloads from reaching hypervisor BFD ports where possible.
How to confirm the fix worked
Confirm that OVN rejects or ignores BFD packets originating from workload interfaces, review cluster logs for absence of crashes under simulated BFD injection, and verify that high-availability failover continues to function correctly.
Typical attack path
- Obtain access to an unprivileged workload such as a VM or container on the affected OVN cluster
- Craft malicious BFD packets that mimic or interfere with legitimate BFD traffic between hypervisors
- Transmit the packets from the workload to the hypervisor BFD endpoints
- Trigger processing that leads to resource exhaustion or crash in the OVN control plane
How to detect it
Inspect OVN northbound and southbound database logs, hypervisor syslog, and BFD session state for unexpected session resets or control-plane restarts correlated with traffic from workload interfaces.
What your security team should do
- Prioritize patching OVN in all clusters that enable BFD for high availability
- Restrict network access so that workload interfaces cannot reach hypervisor BFD endpoints
- Monitor OVN logs and control-plane health for sudden restarts or BFD session flaps
- Test failover behavior after applying updates to ensure availability is restored
The record
A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:12 | ovn | 0 | 23.03.1-1~deb12u2 |
| Debian:13 | ovn | 0 | 24.03.1-1 |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021 | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-central | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-central-debuginfo | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-debuginfo | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-debugsource | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-host | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-host-debuginfo | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-vtep | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn-2021-vtep-debuginfo | 0 | 0:21.12.0-142.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03 | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-central | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-central-debuginfo | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-debuginfo | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-debugsource | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-host | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-host-debuginfo | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-vtep | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.03-vtep-debuginfo | 0 | 0:22.03.3-71.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12 | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-central | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-central-debuginfo | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-debuginfo | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-debugsource | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-host | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-host-debuginfo | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-vtep | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn22.12-vtep-debuginfo | 0 | 0:22.12.1-94.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03 | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-central | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-central-debuginfo | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-debuginfo | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-debugsource | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-host | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-host-debuginfo | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-vtep | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.03-vtep-debuginfo | 0 | 0:23.03.1-100.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06 | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-central | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-central-debuginfo | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-debuginfo | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-debugsource | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-host | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-host-debuginfo | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-vtep | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:8::fastdatapath | ovn23.06-vtep-debuginfo | 0 | 0:23.06.1-112.el8fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03 | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-central | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-central-debuginfo | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-debuginfo | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-debugsource | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-host | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-host-debuginfo | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-vtep | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.03-vtep-debuginfo | 0 | 0:22.03.3-71.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12 | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-central | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-central-debuginfo | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-debuginfo | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-debugsource | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-host | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-host-debuginfo | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-vtep | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn22.12-vtep-debuginfo | 0 | 0:22.12.1-94.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03 | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-central | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-central-debuginfo | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-debuginfo | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-debugsource | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-host | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-host-debuginfo | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-vtep | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.03-vtep-debuginfo | 0 | 0:23.03.1-100.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06 | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-central | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-central-debuginfo | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-debuginfo | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-debugsource | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-host | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-host-debuginfo | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-vtep | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.06-vtep-debuginfo | 0 | 0:23.06.1-112.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09 | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-central | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-central-debuginfo | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-debuginfo | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-debugsource | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-host | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-host-debuginfo | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-vtep | 0 | 0:23.09.0-136.el9fdp |
| Red Hat:enterprise_linux:9::fastdatapath | ovn23.09-vtep-debuginfo | 0 | 0:23.09.0-136.el9fdp |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
| SUSE:Linux Enterprise Micro 5.5 | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openvswitch | 0 | 3.1.7-150600.33.9.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | openvswitch | 0 | 2.11.5-3.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openvswitch | 0 | 3.1.7-150600.33.9.1 |
| Ubuntu:20.04:LTS | ovn | 0 | 20.03.2-0ubuntu0.20.04.5 |
| Ubuntu:22.04:LTS | ovn | 0 | 22.03.3-0ubuntu0.22.04.2 |
| Ubuntu:23.10 | ovn | 0 | 23.09.0-1ubuntu0.1 |
| openSUSE:Leap 15.6 | openvswitch | 0 | 3.1.7-150600.33.9.1 |
| openSUSE:Leap 15.6 | openvswitch3 | 0 | 3.1.7-150500.3.25.1 |
Related vulnerabilities
- CVE-2025-0650 A flaw was found in the Open Virtual Network (OVN). Also affects ovn
- CVE-2023-3966 A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve… Also affects openvswitch3
- CVE-2023-5366 A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets… Also affects openvswitch3
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
- CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346
- CVE-2026-94485 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-94486 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity… CWE-346