Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

The remote host is affected by the vulnerability described in GLSA-202311-16 (Open vSwitch: Multiple Vulnerabilities)

  - A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to     be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

  - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing     can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel     to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-35498)

  - A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker     could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
    (CVE-2021-3905)

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

  - An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4337)

  - An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4338)

  - A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the     datapath flow without the action modifying the IP header. This issue results (for both kernel and     userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for     this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a !=     0 IP protocol that matches this dp flow. (CVE-2023-1668)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2360-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

  - In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe     comparison of minimasks function could lead access to an unmapped region of memory. This vulnerability     is capable of crashing the software, memory modification, and possible remote execution. (CVE-2022-32166)

  - An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4337)

  - An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
    (CVE-2022-4338)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1795-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

  - In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe     comparison of minimasks function could lead access to an unmapped region of memory. This vulnerability     is capable of crashing the software, memory modification, and possible remote execution. (CVE-2022-32166)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:3096-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3758 advisory.

  - coreos-installer: restrict access permissions on /boot/ignition{,/config.ign} (CVE-2021-3917)

  - jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the     WEB-INF directory (CVE-2021-28169)

  - golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196)

  - jetty: SessionListener can prevent a session from being invalidated breaking logout (CVE-2021-34428)

  - openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action     (CVE-2021-36980)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3116-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3099-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3098-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3942 advisory.

  - openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action     (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 21.04 host has packages installed that are affected by a vulnerability as referenced in the USN-5065-1 advisory.

  - Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP     (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. (CVE-2021-36980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186285	GLSA-202311-16 : Open vSwitch: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
176646	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2023:2360-1)	Nessus	SuSE Local Security Checks	critical
174023	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openvswitch (SUSE-SU-2023:1795-1)	Nessus	SuSE Local Security Checks	high
170218	openSUSE 15 Security Update : openvswitch (SUSE-SU-2022:3096-1)	Nessus	SuSE Local Security Checks	medium
165134	RHEL 7 / 8 : OpenShift Container Platform 4.9.0 (RHSA-2021:3758)	Nessus	Red Hat Local Security Checks	medium
164908	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2022:3116-1)	Nessus	SuSE Local Security Checks	medium
164907	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2022:3099-1)	Nessus	SuSE Local Security Checks	medium
164887	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2022:3098-1)	Nessus	SuSE Local Security Checks	medium
154333	RHEL 7 : openvswitch2.11 (RHSA-2021:3942)	Nessus	Red Hat Local Security Checks	medium
153145	Ubuntu 20.04 LTS : Open vSwitch vulnerability (USN-5065-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2021-36980

medium

Tenable Plugins

critical

critical

high

medium

medium

medium

medium

medium

medium

medium