CVE-2022-4338 - openvswitch: Integer Underflow in Organization Specific TLV

Back Back to CVE browser

CRITICAL

openvswitch: Integer Underflow in Organization Specific TLV

Published Jan 10, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.32%

Description

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.

Affected products

Vendor n/a Product Openvswitch Default
n/a
- Version
  openvswitch 3.0.3, openvswitch 2.17.5, openvswitch 2.16.6, openvswitch 2.15.7, openvswitch 2.14.8, openvswitch 2.13.10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Openvswitch

n/a

Version	Status	Constraints
openvswitch 3.0.3, openvswitch 2.17.5, openvswitch 2.16.6, openvswitch 2.15.7, openvswitch 2.14.8, openvswitch 2.13.10	affected	-

Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.13-0:2.13.0-212.el8fdp

Fixed · RHSA-2023:0685
Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.15-0:2.15.0-133.el8fdp

Fixed · RHSA-2023:0687
Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.16-0:2.16.0-111.el8fdp

Fixed · RHSA-2023:0689
Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.17-0:2.17.0-71.el8fdp

Fixed · RHSA-2023:0688
Fast Datapath for Red Hat Enterprise Linux 9

openvswitch2.17-0:2.17.0-62.el9fdp

Fixed · RHSA-2023:0691
Fast Datapath for RHEL 7

openvswitch

Out of support scope
Fast Datapath for RHEL 7

openvswitch2.10

Out of support scope
Fast Datapath for RHEL 7

openvswitch2.11

Out of support scope
Fast Datapath for RHEL 7

openvswitch2.12

Will not fix
Fast Datapath for RHEL 7

openvswitch2.13

Out of support scope
Fast Datapath for RHEL 8

openvswitch2.11

Out of support scope
Fast Datapath for RHEL 8

openvswitch2.12

Will not fix
Red Hat Enterprise Linux 7

openvswitch

Out of support scope
Red Hat OpenShift Container Platform 4

openvswitch2.15

Will not fix
Red Hat OpenShift Container Platform 4

openvswitch2.16

Will not fix
Red Hat OpenShift Container Platform 4

openvswitch2.17

Affected
Red Hat OpenStack Platform 13 (Queens)

openvswitch

Out of support scope
Red Hat OpenStack Platform 13 (Queens)

openvswitch2.11

Out of support scope

Product	Package	State	Advisory
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.13-0:2.13.0-212.el8fdp	Fixed	RHSA-2023:0685
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.15-0:2.15.0-133.el8fdp	Fixed	RHSA-2023:0687
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.16-0:2.16.0-111.el8fdp	Fixed	RHSA-2023:0689
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.17-0:2.17.0-71.el8fdp	Fixed	RHSA-2023:0688
Fast Datapath for Red Hat Enterprise Linux 9	openvswitch2.17-0:2.17.0-62.el9fdp	Fixed	RHSA-2023:0691
Fast Datapath for RHEL 7	openvswitch	Out of support scope	n/a
Fast Datapath for RHEL 7	openvswitch2.10	Out of support scope	n/a
Fast Datapath for RHEL 7	openvswitch2.11	Out of support scope	n/a
Fast Datapath for RHEL 7	openvswitch2.12	Will not fix	n/a
Fast Datapath for RHEL 7	openvswitch2.13	Out of support scope	n/a
Fast Datapath for RHEL 8	openvswitch2.11	Out of support scope	n/a
Fast Datapath for RHEL 8	openvswitch2.12	Will not fix	n/a
Red Hat Enterprise Linux 7	openvswitch	Out of support scope	n/a
Red Hat OpenShift Container Platform 4	openvswitch2.15	Will not fix	n/a
Red Hat OpenShift Container Platform 4	openvswitch2.16	Will not fix	n/a
Red Hat OpenShift Container Platform 4	openvswitch2.17	Affected	n/a
Red Hat OpenStack Platform 13 (Queens)	openvswitch	Out of support scope	n/a
Red Hat OpenStack Platform 13 (Queens)	openvswitch2.11	Out of support scope	n/a

Remediation

Red Hat statement

To exploit this vulnerability, it requires LLDP processing to be enabled for a specific port, which is unlikely to be exploitable in any of the Red Hat products. Considering this restriction, the impact is lowered to moderate.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-191

References (10)

https://access.redhat.com/security/cve/CVE-2022-4338
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2155381
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51691
Advisory
https://github.com/openvswitch/ovs/pull/405
PatchThird Party Advisory
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
Mailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4338
https://security.gentoo.org/glsa/202311-16
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-4338
https://www.debian.org/security/2023/dsa-5319
vendor-advisoryThird Party Advisory
https://www.openwall.com/lists/oss-security/2022/12/21/4
Mailing ListThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-4338		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2155381		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51691		Advisory
https://github.com/openvswitch/ovs/pull/405		PatchThird Party Advisory
https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html		Mailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4338
https://security.gentoo.org/glsa/202311-16		vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-4338
https://www.debian.org/security/2023/dsa-5319		vendor-advisoryThird Party Advisory
https://www.openwall.com/lists/oss-security/2022/12/21/4		Mailing ListThird Party Advisory