Security readout for executives and security teams
Plain-English summary
This vulnerability can crash affected Open vSwitch software when it decodes a malformed RAW_ENCAP OpenFlow action. The known impact is availability, not data theft or privilege escalation. Business urgency is moderate because exploitation is local and requires user interaction, but outages can matter in environments where Open vSwitch supports virtual networking.
Executive priority
Treat this as a moderate-priority availability risk. Patch during the next normal network maintenance window, sooner for platforms where Open vSwitch failure would disrupt production workloads or tenant connectivity.
Technical view
CVE-2021-36980 is a CWE-416 use-after-free in Open vSwitch 2.11.0 through 2.15.0. The flaw occurs in decode_NXAST_RAW_ENCAP, reached through ofpact_decode and ofpacts_decode while decoding RAW_ENCAP actions. CVSS 3.1 is 5.5 with local attack vector, low complexity, no privileges, user interaction required, and high availability impact.
Likely exposure
Exposure is most likely where Open vSwitch 2.11.0 through 2.15.0 is installed and processes OpenFlow action data. The bundle does not identify specific appliances, distributions, or deployment modes beyond Open vSwitch itself.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. OSS-Fuzz and upstream commit references indicate the issue was found and fixed through vulnerability research, but the bundle does not prove real-world exploitation.
Researcher notes
Evidence is strongest for the affected component, vulnerable version range, vulnerability class, and availability impact. The bundle does not provide exploit details, named affected downstream products, or a single fixed release number, so remediation should be tied to upstream commits and vendor advisories.
Mitigation direction
- Inventory Open vSwitch versions and flag 2.11.0 through 2.15.0.
- Apply vendor or distribution updates that include the referenced upstream fixes.
- Review the Gentoo advisory if using Gentoo-packaged Open vSwitch.
- Restrict who can submit or manage OpenFlow actions until patched.
- Monitor Open vSwitch crashes or unexplained datapath/control-plane disruption.
Validation and detection
- Confirm installed Open vSwitch versions are outside the affected range.
- Verify package changelogs or builds include the referenced upstream commits.
- Check vulnerability scanners for CVE-2021-36980 findings on OVS hosts.
- Review operational logs for crashes during OpenFlow action decoding.
- Confirm local access to OVS management interfaces is limited.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36980 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-2020-2197.yamlCVE reference
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851CVE reference
- https://github.com/openvswitch/ovs/commit/77cccc74deede443e8b9102299efc869a52b65b2CVE reference
- https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115300f58fCVE reference
- https://github.com/openvswitch/ovs/commit/65c61b0c23a0d474696d7b1cea522a5016a8aeb3CVE reference
- https://github.com/openvswitch/ovs/commit/6d67310f4d2524b466b98f05ebccc1add1e8cf35CVE reference
- https://github.com/openvswitch/ovs/commit/8ce8dc34b5f73b30ce0c1869af9947013c3c6575CVE reference
- https://github.com/openvswitch/ovs/commit/9926637a80d0d243dbf9c49761046895e9d1a8e2CVE reference
- GLSA-202311-16CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.