Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2026-5265 When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original…

Description

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Produits et versions touchés

Produit Versions touchées Corrigé en
Fast Datapath for RHEL 7 Versions non publiées
Fast Datapath for RHEL 8 Versions non publiées
Fast Datapath for RHEL 9 Versions non publiées
Fast Datapath for RHEL 10 Versions non publiées
Fast Datapath for Red Hat Enterprise Linux 8 Versions non publiées
Fast Datapath for Red Hat Enterprise Linux 9 Versions non publiées
Fast Datapath for Red Hat Enterprise Linux 10 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Fast Datapath for RHEL 7

Les 9 CVE de Fast Datapath for RHEL 7 →
CVE-2026-34956 Openvswitch: open vswitch: denial of service via malformed ftp epasv command 5.9 Moyenne CVE-2026-5367 A flaw was found in OVN (Open Virtual Network) 8.6 Élevée CVE-2024-11614 An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature 7.4 Élevée CVE-2024-52336 Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root 7.8 Élevée
Suivre cette CVE