Cloudanix VulnDB

CVE-2025-0650

High · 8.1

CVSS

8.1

EPSS

0.9%

Published

Jan 23, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A network filtering problem lets specially made packets slip past protections and reach virtual machines that should have been blocked.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Lateral Movement
Component
Network Service
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Specially crafted UDP packets bypass egress ACLs on OVN logical switches that have both DNS records and egress ACLs configured, allowing unauthorized network traffic to reach VMs and containers.

Why it matters to the business

Attackers can reach protected workloads without triggering ACL enforcement, increasing risk of compromise in virtualized environments using OVN on affected Red Hat systems; no ransomware usage or CISA deadline applies.

How an attack unfolds

An attacker crafts UDP packets that exploit DNS record handling to evade egress ACL evaluation on the logical switch, reaching destinations that should be blocked.

How to fix it

Apply the listed fixed kpatch versions for each affected package on Red Hat Enterprise Linux 8: kpatch-patch-4_18_0-305 to 0:1-5.el8, kpatch-patch-4_18_0-305_3_1 to 0:1-4.el8_4, kpatch-patch-4_18_0-305_7_1 to 0:1-3.el8_4, kpatch-patch-4_18_0-305_10_2 to 0:1-2.el8_4, and kpatch-patch-4_18_0-305_12_1 to 0:1-1.el8_4 (including corresponding debuginfo and debugsource packages).

How to confirm the fix worked

Verify installed kpatch package versions match or exceed the fixed releases, confirm OVN logical switch configuration no longer exhibits the bypass with test UDP traffic, and re-test egress ACL enforcement.

Typical attack path

  1. Identify OVN deployment with logical switches containing DNS records and egress ACLs
  2. Craft UDP packets that trigger the ACL bypass condition
  3. Send packets from an external or adjacent network position
  4. Reach protected VMs or containers that should have been filtered

How to detect it

Review OVN northbound and southbound database logs, Open vSwitch flow tables, and network packet captures for UDP traffic reaching destinations that egress ACLs should have dropped.

What your security team should do

  • Prioritize patching all listed kpatch packages on RHEL 8 systems running OVN
  • Audit OVN logical switches for simultaneous use of DNS records and egress ACLs
  • Monitor network flows for unexpected traffic that should have been ACL-blocked

The record

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 ovn 0 No fix
Debian:13 ovn 0 No fix
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS openvswitch3 0 3.1.7-150500.3.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS openvswitch3 0 3.1.0-150500.3.22.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS openvswitch3 0 3.1.7-150500.3.25.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS openvswitch3 0 3.1.0-150500.3.22.1
SUSE:Linux Enterprise Micro 5.5 openvswitch3 0 3.1.7-150500.3.25.1
SUSE:Linux Enterprise Micro 5.5 openvswitch3 0 3.1.0-150500.3.22.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 openvswitch 0 3.1.0-150600.33.6.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 openvswitch 0 3.1.0-150600.33.6.1
SUSE:Linux Enterprise Server 12 SP5-LTSS openvswitch 0 2.11.5-3.24.2
SUSE:Linux Enterprise Server 15 SP4-LTSS openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise Server 15 SP5-LTSS openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise Server 15 SP5-LTSS openvswitch3 0 3.1.7-150500.3.25.1
SUSE:Linux Enterprise Server 15 SP5-LTSS openvswitch3 0 3.1.0-150500.3.22.1
SUSE:Linux Enterprise Server 15 SP6-LTSS openvswitch 0 3.1.7-150600.33.9.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 openvswitch 0 2.11.5-3.24.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 openvswitch 0 2.14.2-150400.24.26.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 openvswitch3 0 3.1.7-150500.3.25.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 openvswitch3 0 3.1.0-150500.3.22.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 openvswitch 0 3.1.7-150600.33.9.1
SUSE:Manager Proxy 4.3 openvswitch 0 2.14.2-150400.24.26.1
SUSE:Manager Server 4.3 openvswitch 0 2.14.2-150400.24.26.1
Ubuntu:20.04:LTS ovn 0 No fix
Ubuntu:20.04:LTS ovn 0 20.03.2-0ubuntu0.20.04.6
Ubuntu:22.04:LTS ovn 0 No fix
Ubuntu:22.04:LTS ovn 0 22.03.3-0ubuntu0.22.04.5
Ubuntu:24.04:LTS ovn 0 No fix
Ubuntu:24.04:LTS ovn 0 24.03.2-0ubuntu0.24.04.2
Ubuntu:24.10 ovn 0 No fix
openSUSE:Leap 15.6 openvswitch 0 3.1.7-150600.33.9.1
openSUSE:Leap 15.6 openvswitch 0 3.1.0-150600.33.6.1
openSUSE:Leap 15.6 openvswitch3 0 3.1.7-150500.3.25.1
openSUSE:Leap 15.6 openvswitch3 0 3.1.0-150500.3.22.1
openSUSE:Tumbleweed openvswitch 0 3.3.2-25.1

Related vulnerabilities