Buffer over-read in Red Hat OpenStack - CVE-2017-9265

Vulnerability identifier: #VU8431

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9265

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the Open vSwitch (OvS) component due to improper parsing of GroupMod OpenFlow messages. A remote attacker can send a specially crafted GroupMod OpenFlow message from the controller in lib/ofp-util.c in the ofputil_pull_ofp15_group_mod function, trigger buffer over-read and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Red Hat OpenStack
Red Hat Virtualization
Red Hat Enterprise Linux Fast Datapath
SUSE Linux
Fedora
openvswitch (Red Hat package)
openvswitch

Install update from vendor's website.

Red Hat OpenStack - addressed in versions 10.0, 11.0
openvswitch (Red Hat package) - addressed in versions 2.4.1-2.git20160727.el7ost, 2.6.1-13.git20161206.el7ost, 2.7.2-1.git20170719.el7fdp
openvswitch - update to 2.7.1-2.fc26

• https://access.redhat.com/errata/RHSA-2017:2698

• Multiple vulnerabilities in Red Hat OpenStack
• SUSE Linux update for openvswitch
• Red Hat update for openvswitch
• Red Hat update for openvswitch
• Fedora 26 update for openvswitch
• Fast Datapath for Red Hat Enterprise Linux 7 update for openvswitch
• Red Hat Enterprise Linux OpenStack Platform 6 update for openvswitch
• Multiple vulnerabilities in Red Hat OpenStack 10.0 packages
• Multiple vulnerabilities in Red Hat OpenStack 11.0 packages