Critical OVSwrap Linux Vulnerability (CVE-2024-3094) Lets Attackers Gain Root

Key Takeaways

• A critical Linux kernel vulnerability, CVE-2024-3094 (dubbed OVSwrap), allows local privilege escalation to root.
• The flaw resides in the Open vSwitch (OVS) kernel datapath, affecting numerous popular Linux distributions.
• Exploitation is highly reliable, requiring no memory grooming, and can be initiated by unprivileged local users.
• Patches are available for stable kernel releases; immediate application is strongly recommended.

A significant vulnerability, identified as CVE-2024-3094 and named OVSwrap, has been uncovered in the Linux kernel. This flaw enables local, unprivileged users to escalate their privileges to root access across a wide array of widely used Linux distributions, posing a substantial security risk.

The core of this vulnerability lies within the Open vSwitch (OVS) kernel datapath. This essential networking component is prevalent in cloud environments, container orchestration, and virtualization platforms. The discovery was made by Asim Viladi Oglu Manizada, who employed an innovative research methodology combining large language models with structured memory-geometry visualizations to dissect intricate kernel memory bugs.

Open vSwitch processes network “actions” originating from userspace, translating them into an internal format stored as Netlink attributes. Each of these attributes includes a length field, which is constrained to a 16-bit value.

While the kernel permits the overall stream of actions to exceed 64 KiB, it previously failed to enforce this 16-bit limit on individual nested actions. This oversight was particularly problematic when a single action, such as a CLONE wrapper containing numerous smaller conntrack actions, surpassed the 65,535-byte threshold.

OVSwrap Linux Vulnerability

When an attacker crafts an action that deliberately exceeds the 65,535-byte boundary, the stored length value silently wraps around to a much smaller number. Subsequent kernel code, trusting this now-wrapped value, proceeds to parse data starting from the middle of attacker-controlled input rather than the actual end of the action. This effectively misleads the parser into interpreting malicious, forged data as legitimate new actions.

The exploit’s reliability is striking. Since conntrack fields, such as labels and timeout names, are under attacker control, and the wraparound occurs at a predictable offset once the kernel build is known, no memory grooming is required. This characteristic makes OVSwrap behave more like a dependable logic bug than a typical, often fragile, memory-corruption issue.

Crucially, exploiting this vulnerability does not necessitate a pre-existing OVS bridge, a running switch daemon, or host-level administrative privileges. An ordinary local user can simply establish an unprivileged user and network namespace using a command like unshare -Urn. Within this isolated namespace, the user can gain CAP_NET_ADMIN capabilities and then initiate a private OVS datapath to access the vulnerable code path.

Given that most Linux distributions ship OVS as a loadable kernel module that automatically loads when needed, the attack surface is present even on systems where OVS was never explicitly installed or activated. This same technique could potentially be extended to facilitate container escape scenarios, further amplifying the threat.

Security researchers confirmed the exploitability of this bug in default configurations across a wide spectrum of the Linux ecosystem. This includes distributions such as AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint, among others. While some systems might require minor configuration adjustments to become vulnerable, older kernel branches that did not receive a related change in 2025 remain unaffected.

The unsafe code responsible for this vulnerability had been present in the kernel for approximately thirteen years. However, it only became exploitable following the removal of an older size limit last year.

The issue was disclosed responsibly to both the kernel security team and OVS maintainers. Patches have since been released and integrated into stable kernel versions, including 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.

What You Should Do

• Apply the available kernel patches immediately to update affected systems to versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or newer.
• If immediate patching is not feasible, blacklist the openvswitch module if it is not a critical component of your system.
• Consider disabling unprivileged user namespaces where practical and not required for system operations.
• Deploy the emergency BPF-based mitigation provided alongside the proof-of-concept as an interim measure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.