Skip to content
Fencer Intel
high 7.5

CVE-2018-17205 json

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c.

published 8y ago modified 4mo ago also EUVD-2018-8967

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.

Patch / fix

  • openvswitch Debian 14, Debian 13, Debian 12 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-1

debian advisories DEBIAN-CVE-2018-17205

  • openvswitch Ubuntu 18.04 LTS 2.9.2-0ubuntu0.18.04.3

ubuntu advisories UBUNTU-CVE-2018-17205

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openvswitch openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch-test openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • python-openvswitch openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch-ovn-host openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch-ovn-vtep openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch-ovn-common openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch-ovn-central openstack 13, openstack 10 2.9.0-83.el7fdp.1
  • openvswitch RHEL 7 2.9.0-70.el7fdp.1

red hat advisories RHSA-2019:0081RHSA-2019:0053RHSA-2018:3500

  • openvswitch SLES for SAP 12 SP3, SLES 12 SP3 2.7.6-3.23.1

suse advisories SUSE-SU-2018:4128-1

Is CVE-2018-17205 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-17205 updated cvss 4.4

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

  • Red Hat OpenStack Platform 12 (Pike) openvswitch, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, openvswitch-ovn-common, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat Virtualization 4 rhvm-appliance, redhat-virtualization-host-image-update
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 7 openvswitch 2.9.0-70.el7fdp.1, openvswitch-test 2.9.0-70.el7fdp.1, python-openvswitch 2.9.0-70.el7fdp.1, openvswitch-ovn-host 2.9.0-70.el7fdp.1, openvswitch-ovn-vtep 2.9.0-70.el7fdp.1, openvswitch-ovn-common 2.9.0-70.el7fdp.1, +1 more
    fixed: vendor fix RHSA-2018:3500
  • Red Hat OpenStack 10.0 Tools for RHEL 7 openvswitch-test 2.9.0-83.el7fdp.1 Red Hat OpenStack Platform 10.0 openvswitch 2.9.0-83.el7fdp.1, python-openvswitch 2.9.0-83.el7fdp.1, openvswitch-ovn-host 2.9.0-83.el7fdp.1, openvswitch-ovn-vtep 2.9.0-83.el7fdp.1, openvswitch-ovn-common 2.9.0-83.el7fdp.1, openvswitch-ovn-central 2.9.0-83.el7fdp.1
    fixed: vendor fix RHSA-2019:0053
  • Red Hat OpenStack Platform 13.0 openvswitch 2.9.0-83.el7fdp.1, openvswitch-test 2.9.0-83.el7fdp.1, python-openvswitch 2.9.0-83.el7fdp.1, openvswitch-ovn-host 2.9.0-83.el7fdp.1, openvswitch-ovn-vtep 2.9.0-83.el7fdp.1, openvswitch-ovn-common 2.9.0-83.el7fdp.1, +1 more
    fixed: vendor fix RHSA-2019:0081
  • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch 2.9.0-70.el7fdp.1, python-openvswitch 2.9.0-70.el7fdp.1, openvswitch-ovn-host 2.9.0-70.el7fdp.1, openvswitch-ovn-common 2.9.0-70.el7fdp.1
    fixed: vendor fix RHSA-2018:3500
  • Red Hat Fast Datapath for RHEL 7 openvswitch2.10, openvswitch2.10-test, python-openvswitch2.10, openvswitch2.10-ovn-host, openvswitch2.10-ovn-vtep, openvswitch2.10-ovn-common, +1 more Red Hat Fast Datapath for RHEL 8 openvswitch2.10, openvswitch2.11, openvswitch2.11-test, python3-openvswitch2.11, network-scripts-openvswitch2.11 Red Hat OpenShift Container Platform 3.2 node Red Hat OpenShift Container Platform 3.3 node Red Hat OpenShift Container Platform 3.4 node Red Hat OpenShift Enterprise 3.0 openvswitch, openvswitch-test, python-openvswitch
    +4 more products
    Red Hat OpenShift Enterprise 3.1 node Red Hat OpenStack Platform 8 (Liberty) openvswitch, python-openvswitch Red Hat OpenStack Platform 9 (Mitaka) openvswitch, python-openvswitch Red Hat OpenStack Platform 14 (Rocky) openvswitch
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.53% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/openvswitch/ovs/commit/0befd1f3745055c32940f5faf9559be6a14395e6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.