PT-2023-1101 · Unknown+6 · Openvswitch+6

Qian Chen · Publicado 2022-12-31 · Atualizado 2023-11-26 · CVE-2022-4337

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenvSwitch (affected versions not specified)

Description The issue is related to an out-of-bounds read in Organization Specific TLV found in OpenvSwitch. It can be exploited by sending specially crafted LLDP messages to the vulnerable system, potentially allowing remote attackers to execute arbitrary code. The vulnerability is also associated with an integer overflow when parsing Auto Attach TLV.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2023-1745

ALT-PU-2023-1806

AZL-12952

BDU:2023-00290

CVE-2022-4337

DLA-3253-1

DSA-5319-1

OPENSUSE-SU-2023_2250-2

RHSA-2023:0685

RHSA-2023:0687

RHSA-2023:0688

RHSA-2023:0689

RHSA-2023:0691

ROSA-SA-2023-2262

SUSE-SU-2023:2250-1

SUSE-SU-2023:2250-2

SUSE-SU-2023:2251-1

SUSE-SU-2023:2255-1

SUSE-SU-2023:2259-1

SUSE-SU-2023:2274-1

SUSE-SU-2023:2275-1

SUSE-SU-2023:2360-1

SUSE-SU-2023_2250-1

SUSE-SU-2023_2251-1

SUSE-SU-2023_2274-1

SUSE-SU-2023_2275-1

USN-5890-1

Produtos afetados

Alt Linux

Astra Linux

Linuxmint

Openvswitch

Red Os

Suse

Ubuntu

Referências · 57

• https://github.com/openvswitch/ovs/pull/405 · Correção
• https://github.com/openvswitch/ovs/commit/7490f281f09a8455c48e19b0cf1b99ab758ee4f4 · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20232360-1 · Nota
• https://bugzilla.suse.com/1203865 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-open-vswitch-cve-2022-4338-cve-2022-4337 · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20232250-2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4337 · Nota de Segurança
• https://security.gentoo.org/glsa/202311-16 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2022-4337 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:2251-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-4337 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-4338 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2022/12/21/4 · Nota
• https://bugzilla.suse.com/1206580 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4337 · Aviso do Fabricante