PT-2023-1102 · Unknown+6 · Openvswitch+6

Qian Chen · Publicado 2022-12-31 · Atualizado 2024-06-15 · CVE-2022-4338

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open vSwitch versions prior to the fixed version

Description The issue is related to an integer underflow in Organization Specific TLV, which can be exploited by sending specially crafted LLDP messages to the vulnerable system, allowing a remote attacker to execute arbitrary code.

Recommendations For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the Organization Specific TLV to minimize the risk of exploitation.

Correção

Integer Underflow

Out of bounds Read

Enumeração de Fraquezas

CWE-191

CWE-125

Identificadores relacionados

ALT-PU-2023-1745

ALT-PU-2023-1806

AZL-12953

BDU:2023-00291

CVE-2022-4338

DLA-3253-1

DSA-5319-1

OESA-2023-1025

OESA-2023-1042

OESA-2023-1043

OPENSUSE-SU-2023_2250-2

OPENSUSE-SU-2024:12860-1

RHSA-2023:0685

RHSA-2023:0687

RHSA-2023:0688

RHSA-2023:0689

RHSA-2023:0691

ROSA-SA-2023-2262

SUSE-SU-2023:2250-1

SUSE-SU-2023:2250-2

SUSE-SU-2023:2251-1

SUSE-SU-2023:2255-1

SUSE-SU-2023:2259-1

SUSE-SU-2023:2274-1

SUSE-SU-2023:2275-1

SUSE-SU-2023:2360-1

USN-5890-1

Produtos afetados

Alt Linux

Astra Linux

Linuxmint

Openvswitch

Red Os

Suse

Ubuntu

Referências · 63

• https://github.com/openvswitch/ovs/pull/405 · Correção
• https://suse.com/support/update/announcement/2023/suse-su-20232360-1 · Nota
• https://bugzilla.suse.com/1203865 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-open-vswitch-cve-2022-4338-cve-2022-4337 · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20232250-2 · Nota
• https://bdu.fstec.ru/vul/2023-00291 · Nota de Segurança
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1042 · Nota
• https://security.gentoo.org/glsa/202311-16 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2023-1042 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:2251-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-4338 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2022-4338 · Nota
• https://osv.dev/vulnerability/AZL-12953 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4338 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2022/12/21/4 · Nota