CVE-2023-41910 — Out-of-bounds Read in Project Lldpd

CWE-125 — Out-of-bounds Read7 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 68.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Lldpd Project Lldpd
Timeline
PublishedSep 5
Latest updateSep 12

Description

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDlldpd_project/lldpd< 1.0.17
▶Debianlldpd_project/lldpd< 1.0.11-1+deb11u2+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5vp9-2h7g-hxq8: An issue was discovered in lldpd before 1↗2023-09-05
▶
CVEList
CVE-2023-41910: An issue was discovered in lldpd before 1↗2023-09-05
▶
OSV
CVE-2023-41910: An issue was discovered in lldpd before 1↗2023-09-05
▶

📋Vendor Advisories

3
Microsoft
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read↗2023-09-12
▶
Red Hat
lldpd: CDP PDU Packet cdp.c out-of-bounds read↗2023-09-05
▶
Debian
CVE-2023-41910: lldpd - An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet wit...↗2023
▶
CVE-2023-41910 — Out-of-bounds Read in Project Lldpd | cvebase