PT-2023-12472 · Lldpd+4 · Lldpd+4

Jeremy Galindo · Publicado 2021-12-02 · Atualizado 2025-03-17 · CVE-2021-43612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lldpd versions prior to 1.0.13

Description The issue arises when decoding SONMP packets in the sonmp decode function, allowing for an out-of-bounds heap read via short SONMP packets.

Recommendations For versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting the processing of short SONMP packets to minimize the risk of exploitation.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALSA-2024:9158

ALT-PU-2021-3442

ALT-PU-2021-3512

ALT-PU-2023-1686

CVE-2021-43612

DLA-3389-1

INFSA-2024_9158

OPENSUSE-SU-2024:11635-1

RHSA-2024:9158

RHSA-2024_9158

RLSA-2024:9158

Produtos afetados

Alt Linux

Almalinux

Red Hat

Rocky Linux

Lldpd

Referências · 33

• https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 · Correção
• https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13 · Correção
• https://access.redhat.com/errata/RHSA-2024:9158 · Nota
• https://linux.oracle.com/errata/ELSA-2024-9158.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-41910 · Nota
• https://cve.org/CVERecord?id=CVE-2021-43612 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-3389-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43612 · Aviso do Fabricante
• https://t.me/cvenotify/48677 · Publicação no Telegram
• https://bugzilla.redhat.com/1921438 · Nota
• https://osv.dev/vulnerability/CVE-2021-43612 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-43612 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2020-27827 · Nota