PT-2021-2225 · Unknown+4 · Openvswitch+4

Joakim Hindersson · Published 2021-02-10 · Updated 2025-04-23 · CVE-2020-35498

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions openvswitch (affected versions not specified)

Description A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet, causing the resulting megaflow in the kernel to be too wide, potentially leading to a denial of service. The highest threat from this issue is to system availability. It is related to an uncontrolled resource consumption in the Open vSwitch software, which can be exploited by a remote attacker using a specially crafted packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2021-1479

ALT-PU-2021-1942

ALT-PU-2021-2054

BDU:2021-01134

CVE-2020-35498

DLA-2571-1

DSA-4852-1

OESA-2021-1179

OPENSUSE-SU-2021:0283-1

OPENSUSE-SU-2021_0283-1

RHSA-2021:0497

RHSA-2021:0834

RHSA-2021:0835

RHSA-2021:0837

RHSA-2021:1050

RHSA-2021:2077

RHSA-2021:2456

SUSE-SU-2021:0436-1

SUSE-SU-2021:0439-1

SUSE-SU-2021:0440-1

SUSE-SU-2021:0446-1

SUSE-SU-2021:0451-1

SUSE-SU-2021:0479-1

SUSE-SU-2021_0436-1

SUSE-SU-2021_0439-1

SUSE-SU-2021_0440-1

SUSE-SU-2021_0446-1

SUSE-SU-2021_0451-1

SUSE-SU-2021_0479-1

SUSE-SU-2022:3384-1

SUSE-SU-2022_3384-1

USN-4729-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Openvswitch

References · 48

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35498 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4729-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35498 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4729-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35498 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0283-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35498 · Security Note
• https://bdu.fstec.ru/vul/2021-01134 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:0440-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27827 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:0436-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35498?_ga=2.261199565.113542731.1612758940-997510329.1585215282 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1179 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1908845 · Patch