PT-2023-1101 · Unknown+6 · Openvswitch+6

Qian Chen · Published 2022-12-31 · Updated 2023-11-26 · CVE-2022-4337

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenvSwitch (affected versions not specified)

Description The issue is related to an out-of-bounds read in Organization Specific TLV found in OpenvSwitch. It can be exploited by sending specially crafted LLDP messages to the vulnerable system, potentially allowing remote attackers to execute arbitrary code. The vulnerability is also associated with an integer overflow when parsing Auto Attach TLV.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-1745

ALT-PU-2023-1806

AZL-12952

BDU:2023-00290

CVE-2022-4337

DLA-3253-1

DSA-5319-1

OPENSUSE-SU-2023_2250-2

RHSA-2023:0685

RHSA-2023:0687

RHSA-2023:0688

RHSA-2023:0689

RHSA-2023:0691

ROSA-SA-2023-2262

SUSE-SU-2023:2250-1

SUSE-SU-2023:2250-2

SUSE-SU-2023:2251-1

SUSE-SU-2023:2255-1

SUSE-SU-2023:2259-1

SUSE-SU-2023:2274-1

SUSE-SU-2023:2275-1

SUSE-SU-2023:2360-1

SUSE-SU-2023_2250-1

SUSE-SU-2023_2251-1

SUSE-SU-2023_2274-1

SUSE-SU-2023_2275-1

USN-5890-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Openvswitch

Red Os

Suse

Ubuntu

References · 57

• https://github.com/openvswitch/ovs/pull/405 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4337 · Security Note
• https://security.gentoo.org/glsa/202311-16 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2251-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4338 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4337 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2250-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2250-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00290 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/692862 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2360-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5319 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2275-1 · Vendor Advisory