Critical severity · published Jul 3, 2016
CVE-2016-2074
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted…
9.8
CVSS
6.4%
EPSS
No
On KEV
Description
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openshift · Redhat
3.1 · source: NVD
OP
Openvswitch · Openvswitch
2.2.0; 2.3.0; 2.3.1; 2.3.2; 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2074
Vendor Advisory
http://openvswitch.org/pipermail/announce/2016-March/000082.html
Patch
http://openvswitch.org/pipermail/announce/2016-March/000083.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0523.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0524.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0537.html
www.debian.org
http://www.debian.org/security/2016/dsa-3533
More from Openvswitch
9.8
CVE-2022-4338
An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch
9.8
CVE-2022-4337
An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch
9.8
CVE-2017-9265
In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function…
9.8
CVE-2017-9264
In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions…
9.8
CVE-2017-9214
In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the…