Technical impact
A heap over‑read occurs when the system generates ICMP Destination Unreachable or Packet Too Big replies; the code copies data from the source packet using the packet’s declared total length without verifying that the declared length is within the actual buffer. The result is that the generated ICMP error includes memory that lies beyond the end of the original packet. An attacker can craft a short packet with an inflated length field, which triggers the over‑read and causes the controller to transmit a malformed ICMP message that leaks arbitrary heap contents. The vulnerability does not provide code execution but could expose sensitive data such as kernel pointers or credentials.
Affected Systems
All Red Hat Fast Datapath releases for RHEL 7, RHEL 8, and RHEL 9 are affected. No specific versioning information is supplied by the vendor. The issue applies to the ovn-controller component within the Fast Datapath stack.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% suggests that exploitation is considered unlikely in the near term. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need access to a virtual machine in the same environment that can send a custom IP packet with a fabricated length field and cause the ovn-controller to respond with an ICMP error. In a typical deployment, this requires the attacker to control traffic that reaches the controller, making the risk moderate but non‑negligible for exposed or poorly segmented networks.
