PT-2017-18792 · Open Vswitch+3 · Openvswitch+3

Bhargava Shastry · Published 2017-05-23 · Updated 2021-08-04 · CVE-2017-9214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open vSwitch (OvS) version 2.7.0

Description The issue is caused by a buffer over-read due to an unsigned integer underflow in the ofputil pull queue get config reply10 function in lib/ofp-util.c, which occurs while parsing an OFPT QUEUE GET CONFIG REPLY type OFP 1.0 message.

Recommendations For Open vSwitch (OvS) version 2.7.0, consider disabling the ofputil pull queue get config reply10 function as a temporary workaround until a patch is available. Restrict access to the lib/ofp-util.c module to minimize the risk of exploitation. Avoid using the OFPT QUEUE GET CONFIG REPLY type OFP 1.0 message in the affected API endpoint until the issue is resolved.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2017-1874

CVE-2017-9214

DLA-2571-1

RHSA-2017:2418

RHSA-2017:2553

RHSA-2017:2648

RHSA-2017:2665

RHSA-2017:2692

RHSA-2017:2698

RHSA-2017:2727

SUSE-SU-2018:0311-1

SUSE-SU-2018:0505-1

USN-3450-1

Affected Products

Alt Linux

Openvswitch

Suse

Ubuntu

References · 55

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9264 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2692 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2648 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27827 · Security Note
• https://bdu.fstec.ru/vul/2021-01805 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2571-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00706 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2418 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2727 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3450-1 · Vendor Advisory
• https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332711.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9265 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-9214 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9263 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8011 · Security Note