CVE-2023-53188

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix race on port output

assume the following setup on a single machine:

1. An openvswitch instance with one bridge and default flows

2. two network namespaces "server" and "client"

3. two ovs interfaces "server" and "client" on the bridge

4. for each ovs interface a veth pair with a matching name and 32 rx and

tx queues

5. move the ends of the veth pairs to the respective network namespaces

6. assign ip addresses to each of the veth ends in the namespaces (needs

to be the same subnet)

7. start some http server on the server network namespace

8. test if a client in the client namespace can reach the http server

when following the actions below the host has a chance of getting a cpu

stuck in a infinite loop:

1. send a large amount of parallel requests to the http server (around

3000 curls should work)

2. in parallel delete the network namespace (do not delete interfaces or

stop the server

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References