PT-2017-13791 · Open Vswitch+2 · Openvswitch+2

Bhargava Shastry · Published 2017-10-01 · Updated 2019-10-03 · CVE-2017-14970

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open vSwitch versions prior to 2.8.1

Description The issue is related to memory leaks that occur while parsing malformed OpenFlow group mod messages. It is noted that the vendor disputes the relevance of this report, stating that it can only be triggered by an OpenFlow controller, which has more direct and powerful ways to force Open vSwitch to allocate memory.

Recommendations For versions prior to 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability of OpenFlow controllers to insert flows into the flow table to minimize the risk of exploitation.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2018-2159

CVE-2017-14970

SUSE-SU-2017:3232-1

SUSE-SU-2017_3232-1

SUSE-SU-2018:0311-1

SUSE-SU-2018:0505-1

SUSE-SU-2018_0311-1

Affected Products

Alt Linux

Openvswitch

Suse

References · 43

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17205 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14970 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00706 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-14970 · Vendor Advisory
• https://mail.openvswitch.org/pipermail/ovs-dev/2017-September/339085.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14970 · Security Note
• https://bdu.fstec.ru/vul/2019-01419 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17206 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:3232-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14970 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17204 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14970 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14970 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-2159 · Vendor Advisory