USN-8659-4: Linux Kernel Open vSwitch Flaw on Oracle Kernels — Detection and Remediation Guide

# Check running kernel flavor and installed Oracle kernel packages
uname -r
dpkg -l | grep linux-oracle

# Confirm whether the Open vSwitch kernel module is loaded
lsmod | grep openvswitch
modinfo openvswitch 2>/dev/null | head -5

---
title: Suspicious Open vSwitch Userspace Interaction by Non-System Process
id: 3f8a2c14-7b9e-4d51-a6c2-8e1f5a9b0d34
status: experimental
description: Detects non-standard processes invoking ovs-vsctl, ovs-ofctl, or ovs-appctl, which may indicate an attacker enumerating or manipulating the Open vSwitch subsystem prior to exploiting a kernel datapath flaw such as the issue addressed in USN-8659-4.
references:
  - https://ubuntu.com/security/notices/USN-8659-4
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/ovs-vsctl'
      - '/ovs-ofctl'
      - '/ovs-appctl'
      - '/ovs-dpctl'
  filter_legit_parents:
    ParentImage|endswith:
      - '/ovs-vswitchd'
      - '/systemd'
      - '/neutron-openvswitch-agent'
      - '/ovn-controller'
  condition: selection and not filter_legit_parents
falsepositives:
  - Legitimate network administrator troubleshooting
  - Automation tooling (Ansible, SaltStack) managing OVS bridges
level: medium
---
title: Unexpected Kernel Module Load on Linux Host
id: 9b4e6d27-1c3a-4f88-b2d5-6a7c9e0f1b28
status: experimental
description: Detects manual kernel module loading via insmod or modprobe executed outside of package management or boot contexts. Kernel module manipulation is a common post-exploitation and rootkit persistence step following kernel privilege escalation such as an Open vSwitch datapath exploit.
references:
  - https://ubuntu.com/security/notices/USN-8659-4
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.006
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection_insmod:
    Image|endswith: '/insmod'
  selection_modprobe_custom:
    Image|endswith: '/modprobe'
    CommandLine|contains:
      - 'openvswitch'
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: 1 of selection_*
falsepositives:
  - Legitimate kernel module management during maintenance windows
  - DKMS rebuilds after kernel updates
level: high
---
title: Unprivileged User Namespace Creation by Interactive Shell
id: 5c1d8e93-2a4b-4f67-9c3e-7d8a0b1e2f45
status: experimental
description: Detects invocation of unshare with user or network namespace flags from an interactive or shell context. User namespace abuse is a frequent prerequisite step for reaching otherwise-restricted kernel code paths (including netlink attack surfaces like Open vSwitch) from unprivileged accounts.
references:
  - https://ubuntu.com/security/notices/USN-8659-4
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/unshare'
    CommandLine|contains:
      - '--user'
      - '-U'
      - '--net'
      - '-n'
  filter_known_tools:
    ParentImage|endswith:
      - '/dockerd'
      - '/containerd'
      - '/podman'
      - '/buildah'
  condition: selection and not filter_known_tools
falsepositives:
  - Developers using rootless containers
  - Flatpak/snap sandboxing
level: medium

// Hunt for OVS utility execution and kernel module manipulation on Linux hosts
// ingested into Microsoft Sentinel via Syslog/CEF or Defender for Endpoint (MDE on Linux).
// Relevant to USN-8659-4 (Open vSwitch kernel subsystem) pre/post-exploitation behavior.

let Lookback = 7d;
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where ProcessName has_any ("ovs-vsctl", "ovs-ofctl", "ovs-appctl", "ovs-dpctl", "insmod")
        or (ProcessName =~ "modprobe" and SyslogMessage has_any ("openvswitch", "/tmp/", "/dev/shm/"))
    | extend Host = Computer, Command = SyslogMessage
    | project TimeGenerated, Host, ProcessName, Command, SourceIP),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("ovs-vsctl", "ovs-ofctl", "ovs-appctl", "ovs-dpctl", "insmod", "unshare")
        or (FileName =~ "modprobe" and ProcessCommandLine has_any ("openvswitch", "/tmp/", "/dev/shm/"))
    | extend Host = DeviceName, Command = ProcessCommandLine, ProcessName = FileName
    | project TimeGenerated, Host, ProcessName, Command, InitiatingProcessAccountName)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ExecutionCount = count()
    by Host, ProcessName, Command
| order by ExecutionCount asc

-- Velociraptor hunt: identify hosts running Oracle-flavored kernels with the
-- Open vSwitch module loaded (patched-or-exposed triage), plus live processes
-- interacting with OVS control tools or loading kernel modules.

-- Part 1: Processes touching OVS tooling or module management
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(ovs-vsctl|ovs-ofctl|ovs-appctl|ovs-dpctl|insmod|modprobe.*openvswitch)'

-- Part 2: Confirm kernel flavor and whether openvswitch module is resident
SELECT * FROM execve(argv=['uname', '-r'])

SELECT Name, Size
FROM parse_file(filename='/proc/modules')
WHERE Name =~ 'openvswitch'

#!/bin/bash
# USN-8659-4 triage and remediation script — Ubuntu Oracle kernel / Open vSwitch
# Run as root on each candidate host. Idempotent; safe for automation.

set -euo pipefail

echo "=== USN-8659-4 Triage: $(hostname) ==="

# 1. Identify kernel flavor
KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"
if [[ "$KERNEL" != *oracle* ]] && ! dpkg -l 2>/dev/null | grep -q linux-oracle; then
    echo "[+] No Oracle kernel detected. This host is likely not in scope for USN-8659-4."
    exit 0
fi

# 2. Check OVS exposure
echo "[*] Checking Open vSwitch exposure..."
if lsmod | grep -q openvswitch; then
    echo "[!] openvswitch kernel module is LOADED — host is actively exposed until patched."
else
    echo "[-] openvswitch module not currently loaded (still patch: code is on disk)."
fi

# 3. Refresh package metadata and apply the kernel security update
echo "[*] Updating package lists and applying security updates..."
apt-get update -qq
apt-get install --only-upgrade -y linux-image-oracle linux-oracle 2>/dev/null || \
    apt-get dist-upgrade -y

# 4. Verify the new kernel package version against the USN
echo "[*] Installed Oracle kernel packages post-update:"
dpkg -l | grep linux-oracle || echo "[!] No linux-oracle packages found — verify manually."

# 5. Check whether a reboot is required (kernel updates ALWAYS require reboot to take effect)
if [ -f /var/run/reboot-required ]; then
    echo "[!] REBOOT REQUIRED — the running kernel is still vulnerable until restart."
    echo "    Schedule: shutdown -r +5 'USN-8659-4 kernel patch'"
else
    echo "[+] No reboot flag set. Confirm running kernel matches installed version:"
    echo "    Running:  $(uname -r)"
    echo "    Installed: $(dpkg -l | awk '/linux-image.*oracle/ {print $3}' | tail -1)"
fi

# 6. Optional hardening: restrict unprivileged user namespaces (common LPE prerequisite)
# Evaluate impact to rootless containers/snapd before enabling.
# sysctl -w kernel.unprivileged_userns_clone=0
# echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/90-disable-userns.conf

echo "=== Triage complete for $(hostname) ==="