Open vSwitch Heap Access Vulnerability via Malformed FTP EPASV Command Leading to Denial-of-Service

A heap access vulnerability has been identified in Open vSwitch. This issue arises when Open vSwitch is set up with a conntrack flow using FTP helpers over the userspace datapath. A remote attacker can exploit this by sending a crafted FTP stream containing an EPASV command that exceeds 255 characters. This exploitation causes a heap access error, which can crash the system, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes the Open vSwitch process to crash, disrupting network services and causing a denial-of-service condition on the affected system.

Remediation

Users can optionally avoid using FTP flows, as these are not typically configured by default. Red Hat users should refer to the Red Hat Security Errata for their specific version for guidance on applying the fix.