PT-2017-13791 · Open Vswitch+2 · Openvswitch+2
Bhargava Shastry
·
Publicado
2017-10-01
·
Atualizado
2019-10-03
·
CVE-2017-14970
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Open vSwitch versions prior to 2.8.1
Description
The issue is related to memory leaks that occur while parsing malformed OpenFlow group mod messages. It is noted that the vendor disputes the relevance of this report, stating that it can only be triggered by an OpenFlow controller, which has more direct and powerful ways to force Open vSwitch to allocate memory.
Recommendations
For versions prior to 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability of OpenFlow controllers to insert flows into the flow table to minimize the risk of exploitation.
Correção
Missing Release of Resource after Effective Lifetime
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Openvswitch
Suse