Cyber Resilience

CVE-2023-1668

High

Published: 10 April 2023

Published
10 April 2023
Modified
23 April 2025
KEV Added
—
Patch
06 April 2023
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS Score 0.0024 47.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-1668 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Cloudbase Open Vswitch. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 47.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a…

more

datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

CWE(s)
CWE-670

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

cloudbase
open vswitch
3.1.0 · 1.5.0 — 2.13.11 · 2.14.0 — 2.14.9 · 2.15.0 — 2.15.8
debian
debian linux
11.0
redhat
openshift container platform
4.0
redhat
openstack platform
16.1, 16.2, 17.0
redhat
virtualization
4.0
redhat
fast datapath
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References