Ethical Hacking News
A previously unknown vulnerability in Open vSwitch's datapath, OVSwrap, has been identified by security researcher Asim Manizada as a major threat to millions of Linux users. By exploiting the bug, an ordinary user can become root administrator on most distributions running with default configurations.
OVSwrap, a 13-year-old vulnerability, allows an ordinary user to gain root privileges on most Linux distributions using Open vSwitch. A local privilege escalation flaw in the Linux kernel's Open vSwitch datapath enables attackers to bypass kernel protections and exploit critical memory structures. The vulnerability affects multiple Linux distributions, including AlmaLinux, Arch, CentOS, Debian, Fedora, Kali, Linux Mint, NixOS, openSUSE, Pop!_OS, and Ubuntu. Users can protect against this vulnerability by installing a patched vendor kernel or blocking future module loads.
OVSwrap, a 13-year-old vulnerability discovered by security researcher Asim Manizada, poses a significant threat to millions of users running various Linux distributions. This previously unknown bug allows an ordinary user to gain root privileges on most distributions using Open vSwitch, rendering current kernel configurations vulnerable.
A local privilege escalation flaw in the Linux kernel's Open vSwitch datapath enables attackers to bypass kernel protections and exploit critical memory structures without needing extensive access rights. As a result, even users with limited capabilities can create a new network namespace, gain control over OVS datapaths, and eventually become root administrators on most distributions.
Distributions tested to be vulnerable include AlmaLinux 9 and 10, Alpine 3.22 through 3.24, Amazon Linux 2023, Arch, CentOS Stream 9 and 10, Debian 12 and 13, Fedora 42 through 44, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9 and 10, and Ubuntu 22.04.
The vulnerability was previously undetectable due to a 32 KiB limit on the total action stream length. However, a change in March 2025 removed this guard, making the bug exploitable once again. The security researcher describes it as having "logic-bug-grade reliability" because no heap grooming is needed for memory corruption.
The tested list of distributions includes major ones such as Ubuntu, which initially blocks direct namespace creation but falls to an aa-exec fallback in the PoC; Ubuntu 26.04 being blocked by default but still exploitable if AppArmor's user-namespace restriction is disabled.
To protect against this vulnerability, users can either install a patched vendor kernel or block future module loads with echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf. Disabling unprivileged user namespaces closes the ordinary local-user route but doesn't prevent container processes from having CAP_NET_ADMIN over network namespaces they control.
Related Information:
https://www.ethicalhackingnews.com/articles/OVSwrap-A-13-Year-Old-Linux-Kernel-Flaw-Exposes-Millions-to-Root-Privileges-ehn.shtml
https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-lets-local-users-become-root.html
https://nvd.nist.gov/vuln/detail/CVE-2023-2731
https://www.cvedetails.com/cve/CVE-2023-2731/
Published: Wed Aug 5 10:29:13 2026 by llama3.2 3B Q4_K_M
