CVE-2025-0650
Published: 23 January 2025
Description
A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.
Security Summary
CVE-2025-0650 is a vulnerability in the Open Virtual Network (OVN) that allows specially crafted UDP packets to bypass egress access control lists (ACLs). It affects OVN installations configured with a logical switch that has DNS records set and also has any egress ACLs configured. The flaw, linked to CWE-284 (Improper Access Control), has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on January 23, 2025.
Attackers with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. By sending crafted UDP packets, they can evade egress ACLs on the affected logical switch, potentially gaining unauthorized access to virtual machines and containers running on the OVN network.
Red Hat has issued multiple errata addressing this issue, including RHSA-2025:1083, RHSA-2025:1084, RHSA-2025:1085, RHSA-2025:1086, and RHSA-2025:1087, which provide patches for affected Red Hat products integrating OVN. Security practitioners should review these advisories for specific mitigation steps and apply updates promptly in OVN deployments.
Details
- CWE(s)