CVE-2025-0650

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network. OVN provides rudimentary DNS caching as an optional feature to speed up lookups of frequently-used domains. When this feature is enabled, due to the OpenFlow rules that OVN installs in Open vSwitch, it is possible for an attacker to craft a UDP packet that can bypass egress ACL rules. Egress ACL rules are those that have the "direction" set to "to-lport". The OVN installation is vulnerable if a logical switch has DNS records set on it AND if the same switch has any egress ACLs configured on it. The switch is considered to have egress ACLs configured if the switch has an egress ACL configured directly on it using the "acls" column of the logical switch. A switch is also considered to have egress ACLs configured if any of its logical switch ports are part of a port group that has egress ACLs configured in its "acls" column. A python script (vuln_test.py) is attached to this advisory and can be used to determine if your installation is vulnerable. Run it in a location where "ovn-nbctl" is installed and can access the northbound database. The script will print to the console whether the installation is vulnerable.

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.

These are all security issues fixed in the libopenvswitch-3_3-0-3.3.2-25.1 package on the GA media of openSUSE Tumbleweed.

This update for openvswitch fixes the following issues:

• CVE-2025-0650: ovn: egress ACLs may be bypassed via specially crafted UDP packet. (bsc#1236353)

This update for openvswitch fixes the following issues:

• CVE-2025-0650: ovn: egress ACLs may be bypassed via specially crafted UDP packet (bsc#1236353).

This update for openvswitch fixes the following issues:

• CVE-2025-0650: ovn: egress ACLs may be bypassed via specially crafted UDP packet (bsc#1236353).

This update for openvswitch3 fixes the following issues:

• CVE-2025-0650: Fixed egress ACLs that may be bypassed via specially crafted UDP packet (bsc#1236353).

This update for openvswitch fixes the following issues:

Update to v3.1.7:

• CVE-2023-3966: openvswitch, openvswitch3: Invalid memory access in Geneve with HW offload (bsc#1219465).
• CVE-2024-2182: openvswitch: ov: insufficient validation of incoming BFD packets may lead to denial of service (bsc#1255435).
• CVE-2023-1668: openvswitch: remote traffic denial of service via crafted packets with IP proto 0 (bsc#1210054).
• CVE-2023-3153: openvswitch,openvswitch3: service monitor MAC flow is not rate limited (bsc#1212125).
• CVE-2023-5366: openvswitch: missing masks on a final stage with ports trie (bsc#1216002).

This update for openvswitch3 fixes the following issues:

Update to v3.1.7:

• CVE-2023-3966: openvswitch, openvswitch3: Invalid memory access in Geneve with HW offload (bsc#1219465).
• CVE-2024-2182: openvswitch: ov: insufficient validation of incoming BFD packets may lead to denial of service (bsc#1255435).
• CVE-2023-1668: openvswitch: remote traffic denial of service via crafted packets with IP proto 0 (bsc#1210054).
• CVE-2023-3153: openvswitch,openvswitch3: service monitor MAC flow is not rate limited (bsc#1212125).
• CVE-2023-5366: openvswitch: missing masks on a final stage with ports trie (bsc#1216002).

This update for openvswitch fixes the following issues:

Update OpenvSwitch to v3.1.7 and OVN to v23.03.3.

Security issues fixed:

• CVE-2023-3966: ovs: invalid memory access and potential denial of service via specially crafted Geneve packets (bsc#1219465).
• CVE-2023-5366: ovs: OpenFlow rules may be bypassed via specially crafted ICMPv6 Neighbor Advertisement packets sent between virtual machines t(bsc#1216002).
• CVE-2024-2182: ovn: denial of service via injection of specially crafted BFD packets from inside unprivileged workloads (bsc#1255435).
• CVE-2025-0650: ovn: egress ACLs may be bypassed via specially crafted UDP packet (bsc#1236353).

Other updates and bugfixes:

• OpenvSwitch:
  • https://www.openvswitch.org/releases/NEWS-3.1.7.txt
  • v3.1.7
    • Bug fixes
    • OVS validated with DPDK 22.11.7.
  • v3.1.6
    • Bug fixes
    • OVS validated with DPDK 22.11.6.
  • v3.1.5
    • Bug fixes
    • OVS validated with DPDK 22.11.5.
  • v3.1.4
    • Bug fixes
    • OVS validated with DPDK 22.11.4.
• OVN:
  • https://github.com/ovn-org/ovn/blob/branch-23.03/NEWS
  • v23.03.3
    • Bug fixes
    • Add "garp-max-timeout-sec" config option to vswitchd external-ids to cap the time between when ovn-controller sends gARP packets.
  • v23.03.1
    • Bug fixes
    • CT entries are not flushed by default anymore whenever a load balancer backend is removed. A new, per-LB, option 'ct_flush' can be used to restore the previous behavior. Disabled by default.
    • Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast Listener Discovery protocols, regardless of ACLs defined.
    • Send ICMP Fragmentation Needed packets back to offending ports when communicating with multichassis ports using frames that don't fit through a tunnel. This is done only for logical switches that are attached to a physical network via a localnet port, in which case multichassis ports may have an effective MTU different from regular ports and hence may need this mechanism to maintain connectivity with other peers in the network.
    • ECMP routes use L4_SYM dp-hash by default if the datapath supports it. Existing sessions might get re-hashed to a different ECMP path when OVN detects the algorithm support in the datapath during an upgrade or restart of ovn-controller.

This update for openvswitch fixes the following issues:

Update OpenvSwitch to v3.1.7 and OVN to v23.03.3:

Security issues fixed:

• CVE-2023-3966: ovs: invalid memory access and potential denial of service via specially crafted Geneve packets (bsc#1219465).
• CVE-2023-5366: ovs: OpenFlow rules may be bypassed via specially crafted ICMPv6 Neighbor Advertisement packets sent between virtual machines t(bsc#1216002).
• CVE-2024-2182: ovn: denial of service via injection of specially crafted BFD packets from inside unprivileged workloads (bsc#1255435).
• CVE-2025-0650: ovn: egress ACLs may be bypassed via specially crafted UDP packet (bsc#1236353).

Other updates and bugfixes:

• OpenvSwitch upstream bugfix updates:

  • https://www.openvswitch.org/releases/NEWS-3.1.7.txt
  • v3.1.7
    • Bug fixes
    • OVS validated with DPDK 22.11.7.
  • v3.1.6
    • Bug fixes
    • OVS validated with DPDK 22.11.6.
  • v3.1.5
    • Bug fixes
    • OVS validated with DPDK 22.11.5.
  • v3.1.4
    • Bug fixes
    • OVS validated with DPDK 22.11.4.

• OVN upstream bugfix updates:

  • https://github.com/ovn-org/ovn/blob/branch-23.03/NEWS
  • v23.03.3
    • Bug fixes
    • Add "garp-max-timeout-sec" config option to vswitchd external-ids to cap the time between when ovn-controller sends gARP packets.
  • v23.03.1
    • Bug fixes
    • CT entries are not flushed by default anymore whenever a load balancer backend is removed. A new, per-LB, option 'ct_flush' can be used to restore the previous behavior. Disabled by default.
    • Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast Listener Discovery protocols, regardless of ACLs defined.
    • Send ICMP Fragmentation Needed packets back to offending ports when communicating with multichassis ports using frames that don't fit through a tunnel. This is done only for logical switches that are attached to a physical network via a localnet port, in which case multichassis ports may have an effective MTU different from regular ports and hence may need this mechanism to maintain connectivity with other peers in the network.
    • ECMP routes use L4_SYM dp-hash by default if the datapath supports it. Existing sessions might get re-hashed to a different ECMP path when OVN detects the algorithm support in the datapath during an upgrade or restart of ovn-controller.

This update for openvswitch fixes the following issues:

• CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
• CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).

Marius Berntsberg, Trygve Vea, Tore Anderson, Rodolfo Alonso, Jay Faulkner, and Brian Haley discovered that OVN incorrectly handled certain crafted UDP packets. A remote attacker could possibly use this issue to bypass egress ACL rules.