PT-2023-9187 · Lldpd+5 · Lldpd+5
Matteo Memelli
·
Publicado
2023-09-04
·
Atualizado
2025-03-17
·
CVE-2023-41910
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
lldpd versions prior to 1.0.17
Description
An issue was discovered in the handling of CDP PDU packets with specific
CDP TLV ADDRESSES TLVs. A malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in the cdp decode function in daemon/protocols/cdp.c. The vulnerability may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.Recommendations
For versions prior to 1.0.17, update to version 1.0.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the
cdp decode function in daemon/protocols/cdp.c to minimize the risk of exploitation. Avoid using the CDP TLV ADDRESSES TLVs in CDP PDU packets until the issue is resolved.Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Red Hat
Red Os
Rocky Linux
Lldpd