Description
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openvswitch (ovs) | Fixed in v2.17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | openvswitch2.13 +5 | 2.13.0-139.el8fdp | RHBA-2022:0051 |
| RHEL 8 | openvswitch2.15 +5 | 2.15.0-55.el8fdp | RHBA-2022:0052 |
| RHEL 8 | openvswitch2.16 +5 | 2.16.0-86.el8fdp | RHBA-2022:5792 |
Advisories 3
- RHBA-2022:5792 Red Hat Bug Fix Advisory: openvswitch2.16 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2022:0052 Red Hat Bug Fix Advisory: openvswitch2.15 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2022:0051 Red Hat Bug Fix Advisory: openvswitch2.13 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2019692
- https://access.redhat.com/security/cve/CVE-2021-3905
- https://ubuntu.com/security/CVE-2021-3905
- https://github.com/openvswitch/ovs-issues/issues/226
- https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349
- GLSA-202311-16 vendor-advisory