Security update for openvswitch SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1795-1 Final 1 1 2023-04-07T09:06:37Z current 2023-04-07T09:06:37Z 2023-04-07T09:06:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openvswitch This update for openvswitch fixes the following issues: - CVE-2021-36980: Fixed a use-after-free issue during the decoding of a RAW_ENCAP action (bsc#1188524). - CVE-2022-32166: Fixed a out of bounds read in minimask_equal() (bsc#1203865). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-1795,SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-1795,openSUSE-SLE-15.4-2023-1795 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231795-1/ Link for SUSE-SU-2023:1795-1 https://lists.suse.com/pipermail/sle-security-updates/2023-April/014430.html E-Mail link for SUSE-SU-2023:1795-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188524 SUSE Bug 1188524 https://bugzilla.suse.com/1203865 SUSE Bug 1203865 https://www.suse.com/security/cve/CVE-2021-36980/ SUSE CVE CVE-2021-36980 page https://www.suse.com/security/cve/CVE-2022-32166/ SUSE CVE CVE-2022-32166 page SUSE Linux Enterprise Module for Package Hub 15 SP4 openSUSE Leap 15.4 dpdk-18.11.9-150100.4.23.1 dpdk-devel-18.11.9-150100.4.23.1 dpdk-doc-18.11.9-150100.4.23.1 dpdk-examples-18.11.9-150100.4.23.1 dpdk-kmp-default-18.11.9_k4.12.14_150100.197.137-150100.4.23.1 dpdk-thunderx-18.11.9-150100.4.23.1 dpdk-thunderx-devel-18.11.9-150100.4.23.1 dpdk-thunderx-doc-18.11.9-150100.4.23.1 dpdk-thunderx-examples-18.11.9-150100.4.23.1 dpdk-thunderx-kmp-default-18.11.9_k4.12.14_150100.197.137-150100.4.23.1 dpdk-thunderx-tools-18.11.9-150100.4.23.1 dpdk-tools-18.11.9-150100.4.23.1 libdpdk-18_11-18.11.9-150100.4.23.1 libopenvswitch-2_11-0-2.11.5-150100.3.18.2 openvswitch-2.11.5-150100.3.18.2 openvswitch-devel-2.11.5-150100.3.18.2 openvswitch-doc-2.11.5-150100.3.18.2 openvswitch-ipsec-2.11.5-150100.3.18.2 openvswitch-ovn-central-2.11.5-150100.3.18.2 openvswitch-ovn-common-2.11.5-150100.3.18.2 openvswitch-ovn-docker-2.11.5-150100.3.18.2 openvswitch-ovn-host-2.11.5-150100.3.18.2 openvswitch-ovn-vtep-2.11.5-150100.3.18.2 openvswitch-pki-2.11.5-150100.3.18.2 openvswitch-test-2.11.5-150100.3.18.2 openvswitch-vtep-2.11.5-150100.3.18.2 python2-ovs-2.11.5-150100.3.18.2 python3-ovs-2.11.5-150100.3.18.2 libdpdk-18_11-18.11.9-150100.4.23.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libopenvswitch-2_11-0-2.11.5-150100.3.18.2 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libdpdk-18_11-18.11.9-150100.4.23.1 as a component of openSUSE Leap 15.4 libopenvswitch-2_11-0-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 openvswitch-ovn-central-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 openvswitch-ovn-common-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 openvswitch-ovn-docker-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 openvswitch-ovn-host-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 openvswitch-ovn-vtep-2.11.5-150100.3.18.2 as a component of openSUSE Leap 15.4 Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. CVE-2021-36980 SUSE Linux Enterprise Module for Package Hub 15 SP4:libdpdk-18_11-18.11.9-150100.4.23.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libopenvswitch-2_11-0-2.11.5-150100.3.18.2 openSUSE Leap 15.4:libdpdk-18_11-18.11.9-150100.4.23.1 openSUSE Leap 15.4:libopenvswitch-2_11-0-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-central-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-common-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-docker-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-host-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-vtep-2.11.5-150100.3.18.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231795-1/ https://www.suse.com/security/cve/CVE-2021-36980.html CVE-2021-36980 https://bugzilla.suse.com/1188524 SUSE Bug 1188524 https://bugzilla.suse.com/1196498 SUSE Bug 1196498 In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution. CVE-2022-32166 SUSE Linux Enterprise Module for Package Hub 15 SP4:libdpdk-18_11-18.11.9-150100.4.23.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:libopenvswitch-2_11-0-2.11.5-150100.3.18.2 openSUSE Leap 15.4:libdpdk-18_11-18.11.9-150100.4.23.1 openSUSE Leap 15.4:libopenvswitch-2_11-0-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-central-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-common-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-docker-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-host-2.11.5-150100.3.18.2 openSUSE Leap 15.4:openvswitch-ovn-vtep-2.11.5-150100.3.18.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231795-1/ https://www.suse.com/security/cve/CVE-2022-32166.html CVE-2022-32166 https://bugzilla.suse.com/1203865 SUSE Bug 1203865