CVE-2024-38558

A flaw was found in the Linux kernel's Open vSwitch (OVS) component. When processing Internet Control Message Protocol for IPv6 (ICMPv6) packets during datapath execution commands, the kernel inadvertently overwrites connection tracking metadata shared in memory. A local user can exploit this vulnerability to cause incorrect flow matching and improper packet handling, leading to network flow disruption and a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local privileges to execute actions via the Open vSwitch datapath netlink interface and is limited to causing network disruption or denial of service without compromising system integrity. The flaw is confined to the specific packet execution command path and does not affect transit traffic entering Open vSwitch directly from physical or virtual network interfaces. Furthermore, Open vSwitch is not enabled by default on standard Red Hat Enterprise Linux installations, restricting exposure to environments actively utilizing Open vSwitch or OVN-based networking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.