CVE-2017-9264

openvswitch: Buffer over-read while parsing malformed TCP, UDP and IPv6 packets

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.

En la biblioteca lib/conntrack.c en la implementación del firewall en Open vSwitch (OvS) versión 2.6.1, se presenta una lectura excesiva del búfer mientras se analizan los paquetes TCP, UDP e IPv6 malformados en las funciones “extract_l3_ipv6”, “extract_l4_tcp” y “extract_l4_udp” que pueden ser activadas remotamente.

A buffer over-read was found in the Open vSwitch (OvS) firewall implementation. This flaw can be triggered by parsing a specially crafted TCP, UDP, or IPv6 packet. A remote attack could use this flaw to cause a Denial of Service (DoS).

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-05-28 CVE Reserved
2017-05-29 CVE Published
2023-05-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read

CAPEC

References (6)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/329323.html	2019-10-03

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2017:2418	2019-10-03
https://access.redhat.com/errata/RHSA-2017:2648	2019-10-03
https://access.redhat.com/errata/RHSA-2017:2727	2019-10-03
https://access.redhat.com/security/cve/CVE-2017-9264	2017-09-13
https://bugzilla.redhat.com/show_bug.cgi?id=1457329	2017-09-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openvswitch Search vendor "Openvswitch"		Openvswitch Search vendor "Openvswitch" for product "Openvswitch"				2.6.1 Search vendor "Openvswitch" for product "Openvswitch" and version "2.6.1"		-		Affected