PT-2021-22361 · Unknown+2 · Openvswitch+2

Wan Junjie · Published 2021-11-08 · Updated 2023-11-26 · CVE-2021-3905

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open vSwitch (OVS) (affected versions not specified)

Description A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2023-1745

ALT-PU-2023-1806

CVE-2021-3905

OESA-2022-1778

ROSA-SA-2023-2262

USN-5242-1

Affected Products

Alt Linux

Openvswitch

Ubuntu

References · 14

• 🔥 https://github.com/openvswitch/ovs-issues/issues/226 · Exploit
• https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3905 · Security Note
• https://ubuntu.com/security/notices/USN-5242-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2019692 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3905 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3905 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1778 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3905 · Security Note
• https://ubuntu.com/security/CVE-2021-3905 · Patch
• https://security.gentoo.org/glsa/202311-16 · Vendor Advisory
• https://t.me/cvenotify/61195 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1778 · Note
• https://access.redhat.com/security/cve/CVE-2021-3905 · Note