Description (CNA)
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 10 | unaffected 0:25.03.2-100.el10fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 10 | unaffected 0:25.09.2-103.el10fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 8 | unaffected 0:21.12.0-145.el8fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 8 | unaffected 0:23.06.4-30.el8fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 9 | unaffected 0:23.06.4-30.el9fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 9 | unaffected 0:23.09.6-16.el9fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 9 | unaffected 0:24.03.7-82.el9fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 9 | unaffected 0:25.03.2-100.el9fdp before * |
| Red Hat / Fast Datapath for Red Hat Enterprise Linux 9 | unaffected 0:25.09.2-103.el9fdp before * |
| Red Hat / Fast Datapath for RHEL 7 | affected |
| Red Hat / Fast Datapath for RHEL 7 | affected |
| Red Hat / Fast Datapath for RHEL 7 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 8 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
| Red Hat / Fast Datapath for RHEL 9 | affected |
CWE
CWE-130
References
- https://access.redhat.com/errata/RHSA-2026:11694
- https://access.redhat.com/errata/RHSA-2026:11695
- https://access.redhat.com/errata/RHSA-2026:11696
- https://access.redhat.com/errata/RHSA-2026:11698
- https://access.redhat.com/errata/RHSA-2026:11700
- https://access.redhat.com/errata/RHSA-2026:11701
- https://access.redhat.com/errata/RHSA-2026:11702
- https://access.redhat.com/errata/RHSA-2026:22110
- https://access.redhat.com/errata/RHSA-2026:22111
- https://access.redhat.com/security/cve/CVE-2026-5265
- https://bugzilla.redhat.com/show_bug.cgi?id=2453458
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.