CVE-2018-17204 An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c.

Medium 4.3 Published 19 Sep 2018 Updated 5 Aug 2024

Exploited in the wild: Not known
Fix: Available

What is CVE-2018-17204?

CVE-2018-17204 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 19 Sep 2018.

Official description

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.

Weakness: CWE-617

Which versions are affected by CVE-2018-17204?

It affects 4 products.

Linux distribution packages (4)

`redhat-release-virtualization-host` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:4.2-7.5.el7`
`redhat-virtualization-host` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:4.2-20181121.0.el7_6`
`redhat-virtualization-host-image-update` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:4.2-20181121.0.el7_6`
`redhat-virtualization-host-image-update-placeholder` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:4.2-7.5.el7`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Openvswitch Openvswitch, Redhat Openstack.

How do I fix CVE-2018-17204?

Upgrade to a fixed version.

Is CVE-2018-17204 being exploited?

There is no known exploitation of CVE-2018-17204 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-17204, GHSA-4wv2-475w-c2fw, RHBA-2018:3683, UBUNTU-CVE-2018-17204.