[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <78c56608-8d3d-c770-3797-e1fd4fd37c43@ovn.org>
Date: Wed, 21 Dec 2022 12:10:03 +0100
From: Ilya Maximets <i.maximets@....org>
To: oss-security@...ts.openwall.com, ovs-announce@...nvswitch.org,
ovs-discuss <ovs-discuss@...nvswitch.org>
Cc: i.maximets@....org, Aaron Conole <aconole@...hat.com>,
Qian Chen <cq674350529@...il.com>, John Helmert III <ajak@...too.org>
Subject: Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV
(Open vSwitch)
On 12/20/22 22:39, Ilya Maximets wrote:
> Description
> ===========
>
> Multiple versions of Open vSwitch are vulnerable to crafted LLDP
> packets causing denial of service, and data underflow attacks.
> Triggering the vulnerabilities requires LLDP processing to be enabled
> for a specific port. Open vSwitch versions prior to 2.4.0 are not
> vulnerable.
>
> The Common Vulnerabilities and Exposures project (cve.mitre.org)
> did not assign the identifier to this issue yet. The identifier will
> be communicated separately.
Following CVE identifiers have been allocated for the issue (one per
TLV type since they can have a slightly different effect):
- CVE-2022-4337 for Out-of-Bounds Read in Organization Specific TLV
- CVE-2022-4338 for Integer Underflow in Organization Specific TLV
The fix referenced in this advisory covers both issues.
> This issue does not affect the `lldpd'
> project, although they share a code base. The issue is related to
> parsing the Auto Attach TLVs, which is specific to the Open vSwitch
> implementation.
>
>
> Mitigation
> ==========
>
> For any version of Open vSwitch, preventing LLDP packets from reaching
> Open vSwitch mitigates the vulnerability. We do not recommend
> attempting to mitigate the vulnerability this way because of the
> following difficulties:
>
> - Open vSwitch obtains packets before the iptables host firewall,
> so ebtables on the Open vSwitch host cannot ordinarily block the
> vulnerability.
>
> - If Open vSwitch is configured to receive and transmit LLDP
> messages, the required functionality will need to be disabled
> potentially disrupting the network.
>
> We have found that Open vSwitch is subject to a denial of service, and
> possibly a remote code execution exploit when LLDP processing is enabled
> on an interface. By default, interfaces are not configured to process
> LLDP messages.
>
>
> Fix
> ===
>
> Patches to fix these vulnerabilities in Open vSwitch 2.13.x and newer are
> applied to the appropriate branches, and the original patch is located
> at:
>
> https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
>
> Recommendation
> ==============
>
> We recommend that users of Open vSwitch apply the respective patch, or
> upgrade to a known patched version of Open vSwitch. These include:
>
> * 3.0.3
> * 2.17.5
> * 2.16.6
> * 2.15.7
> * 2.14.8
> * 2.13.10
>
>
> Acknowledgments
> ===============
>
> The Open vSwitch team wishes to thank the reporter:
>
> Qian Chen <cq674350529@...il.com>
>
Download attachment "OpenPGP_0xB9F7EC77C829BF96.asc" of type "application/pgp-keys" (4740 bytes)
Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
