PT-2023-12472 · Lldpd+4 · Lldpd+4

Jeremy Galindo · Published 2021-12-02 · Updated 2025-03-17 · CVE-2021-43612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lldpd versions prior to 1.0.13

Description The issue arises when decoding SONMP packets in the sonmp decode function, allowing for an out-of-bounds heap read via short SONMP packets.

Recommendations For versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting the processing of short SONMP packets to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2024:9158

ALT-PU-2021-3442

ALT-PU-2021-3512

ALT-PU-2023-1686

CVE-2021-43612

DLA-3389-1

INFSA-2024_9158

OPENSUSE-SU-2024:11635-1

RHSA-2024:9158

RHSA-2024_9158

RLSA-2024:9158

Affected Products

Alt Linux

Almalinux

Red Hat

Rocky Linux

Lldpd

References · 33

• https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 · Patch
• https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13 · Patch
• https://linux.oracle.com/errata/ELSA-2024-9158.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43612 · Security Note
• https://osv.dev/vulnerability/DLA-3389-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43612 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43612 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:9158 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-9158.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43612 · Security Note
• https://lldpd.github.io/security.html · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11635-1 · Vendor Advisory