ovn-central: A flaw was found in the Open Virtual Network (OVN)

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDPpackets may bypass egress access control lists (ACLs) in OVN installationsconfigured with a logical switch with DNS records set on it and if the sameswitch has any egress ACLs configured. This issue can lead to unauthorizedaccess to virtual machines and containers running on the OVN network.OVN provides rudimentary DNS caching as an optional feature to speed uplookups of frequently-used domains. When this feature is enabled, due tothe OpenFlow rules that OVN installs in Open vSwitch, it is possible foran attacker to craft a UDP packet that can bypass egress ACL rules.Egress ACL rules are those that have the "direction" set to "to-lport".The OVN installation is vulnerable if a logical switch has DNS recordsset on it AND if the same switch has any egress ACLs configured on it.The switch is considered to have egress ACLs configured if the switchhas an egress ACL configured directly on it using the "acls" column ofthe logical switch. A switch is also considered to have egress ACLsconfigured if any of its logical switch ports are part of a port groupthat has egress ACLs configured in its "acls" column.A python script (vuln_test.py) is attached to this advisory and can beused to determine if your installation is vulnerable. Run it in alocation where "ovn-nbctl" is installed and can access the northbounddatabase. The script will print to the console whether the installationis vulnerable.

Where it's fixed