CVE-2023-3966 – CVE-2023-3966 is a vulnerability in Open vSwitc... (How to Fix)

Q: What is the severity of CVE-2023-3966?

CVE-2023-3966 has a CVSS score of 7.5 (HIGH). CVE-2023-3966 is a vulnerability in Open vSwitch where specially crafted Geneve packets can cause denial of service and invalid memory accesses when hardware offloading via netlink is enabled. This affects systems running vulnerable versions of Open vSwitch with hardware offloading configured. Network administrators and organizations using Open vSwitch for virtualization or SDN are primarily affected.

📋 TL;DR

CVE-2023-3966 is a vulnerability in Open vSwitch where specially crafted Geneve packets can cause denial of service and invalid memory accesses when hardware offloading via netlink is enabled. This affects systems running vulnerable versions of Open vSwitch with hardware offloading configured. Network administrators and organizations using Open vSwitch for virtualization or SDN are primarily affected.

💻 Affected Systems

Products:

Open vSwitch

Versions: Multiple versions prior to fixes (specific versions vary by distribution)

Operating Systems: Linux distributions including Red Hat, Fedora, CentOS, Ubuntu, Debian

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when hardware offloading via netlink path is enabled. Default configurations typically do not have this enabled.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service of the Open vSwitch instance, potentially crashing the network virtualization layer and disrupting all virtual network traffic.

🟠

Likely Case

Service disruption of Open vSwitch, causing network connectivity issues for virtual machines and containers relying on the affected switch.

🟢

If Mitigated

Minimal impact if hardware offloading is disabled or proper network segmentation prevents malicious packets from reaching vulnerable systems.

🌐 Internet-Facing: MEDIUM - Requires specific network access to send crafted Geneve packets, but many Open vSwitch deployments are internal.

🏢 Internal Only: HIGH - Internal attackers or compromised systems could exploit this to disrupt critical network infrastructure.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires network access to send crafted Geneve packets and hardware offloading to be enabled. No public exploit code has been identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by distribution - check vendor advisories for specific fixed versions

Vendor Advisory: https://access.redhat.com/security/cve/CVE-2023-3966

Restart Required: Yes

Instructions:

1. Check your distribution's security advisories. 2. Update Open vSwitch packages to patched versions. 3. Restart Open vSwitch services. 4. Verify the update was successful.

🔧 Temporary Workarounds

Disable hardware offloading

linux

Disable hardware offloading via netlink path to prevent exploitation

ovs-vsctl set Open_vSwitch . other_config:hw-offload=false
systemctl restart openvswitch

🧯 If You Can't Patch

Disable hardware offloading via netlink path configuration
Implement network segmentation to restrict Geneve packet traffic to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check Open vSwitch version and verify if hardware offloading is enabled: ovs-vsctl get Open_vSwitch . other_config:hw-offload

Check Version:

ovs-vsctl --version

Verify Fix Applied:

Verify Open vSwitch version is updated to patched version and hardware offloading is either disabled or the system is patched

📡 Detection & Monitoring

Log Indicators:

Open vSwitch crash logs
Kernel panic messages related to memory access violations
Increased error rates in Open vSwitch logs

Network Indicators:

Unusual Geneve packet patterns
Sudden loss of virtual network connectivity

SIEM Query:

source="openvswitch" AND ("crash" OR "panic" OR "memory access")

📊 Metadata

CVE ID: CVE-2023-3966

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-248

Published: February 22, 2024

Last Updated: May 16, 2025

🔗 References

https://access.redhat.com/security/cve/CVE-2023-3966 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2178363 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/ Mailing List
https://access.redhat.com/security/cve/CVE-2023-3966 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2178363 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/ Mailing List

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-3966, you might also want to check these: