8.2

CVE-2023-1668: cloudbase open_vswitch

CVSS: 8.2v3.1HighModified
AliasesSUSE-SU-2023:2296-1SUSE-SU-2023:2536-1SUSE-SU-2023:2621-1
Published 10-04-2023Last modified 23-04-2025
Open JSON

Vulnerability summary

CVE-2023-1668 is a high (CVSS 8.2) vulnerability in cloudbase open_vswitch. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
1.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 4
RHSA-2023:3491SUSE-SU-2023:2274-1SUSE-SU-2023:2275-1SUSE-SU-2026:0280-1SUSE-SU-2026:0290-1

Timeline

  1. 10-04-2023
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.22%

Chance of exploitation in the next 30 days

Percentile

68%

Versus all other CVEs

30-day change

0.00 pp

From 1.22% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat40 products
Suse7 products
  • openvswitch3&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 3.1.0-150500.3.3.1
  • openvswitch&distro=SUSE Linux Enterprise Module for Legacy 15 SP5< 2.14.2-150400.24.9.1
  • openvswitch&distro=SUSE Linux Enterprise Module for Package Hub 15 SP4< 2.14.2-150400.24.9.1
  • openvswitch&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 2.14.2-150400.24.9.1
  • openvswitch&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 2.14.2-150400.24.9.1
Opensuse4 products
  • openvswitch3&distro=openSUSE Leap 15.5< 3.1.0-150500.3.3.1
  • openvswitch&distro=openSUSE Leap 15.4< 2.14.2-150400.24.9.1
  • openvswitch&distro=openSUSE Leap 15.5< 2.14.2-150400.24.9.1
  • openvswitch&distro=openSUSE Tumbleweed< 3.1.0-14.1
Debian2 products
  • openvswitch< 3.1.0-2 | < 2.15.0+ds1-2+deb11u4 | < 2.10.7+ds1-0+deb10u4
  • debian_linuxEOL11.0
Cloudbase1 product
  • open_vswitch≥ 1.5.0, < 2.13.11 | ≥ 2.14.0, < 2.14.9 | ≥ 2.15.0, < 2.15.8 | ≥ 2.16.0, < 2.16.7 | ≥ 2.17.0, < 2.17.6 | ≥ 3.0.0, < 3.0.4 | 3.1.0
Ubuntu1 product
  • openvswitchAll versions (No fix recorded) | < 2.9.8-0ubuntu0.18.04.5 | < 2.13.8-0ubuntu1.2 | < 2.17.5-0ubuntu0.22.04.2

6 vendors · 55 products

References

38 links
Show all 38 references