Sign-up

ID

VAR-202201-1309


CVE

CVE-2021-3905


TITLE

Open vSwitch  of  Open vSwitch  Vulnerability related to lack of free memory after expiration in products from other vendors

Trust: 0.8

sources: JVNDB: JVNDB-2021-020198

DESCRIPTION

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments. Open vSwitch of Open vSwitch Products from multiple other vendors are vulnerable to lack of freeing memory after expiration.Service operation interruption (DoS) It may be in a state. ========================================================================== Ubuntu Security Notice USN-5242-1 January 20, 2022 openvswitch vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 Summary: Open vSwitch could be made to hang or crash if it received specially crafted network traffic. Software Description: - openvswitch: Ethernet virtual switch Details: It was discovered that Open vSwitch incorrectly handled certain fragmented packets. A remote attacker could possibly use this issue to cause Open vSwitch to consume resources, leading to a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: openvswitch-common 2.16.0-0ubuntu2.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5242-1 CVE-2021-3905 Package Information: https://launchpad.net/ubuntu/+source/openvswitch/2.16.0-0ubuntu2.1 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202311-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Open vSwitch: Multiple Vulnerabilities Date: November 26, 2023 Bugs: #765346, #769995, #803107, #887561 ID: 202311-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple denial of service vulnerabilites have been found in Open vSwitch. Background ========= Open vSwitch is a production quality multilayer virtual switch. Affected packages ================ Package Vulnerable Unaffected -------------------- ------------ ------------ net-misc/openvswitch < 2.17.6 >= 2.17.6 Description ========== Multiple vulnerabilities have been discovered in Open vSwitch. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Open vSwitch users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openvswitch-2.17.6" References ========= [ 1 ] CVE-2020-27827 https://nvd.nist.gov/vuln/detail/CVE-2020-27827 [ 2 ] CVE-2020-35498 https://nvd.nist.gov/vuln/detail/CVE-2020-35498 [ 3 ] CVE-2021-3905 https://nvd.nist.gov/vuln/detail/CVE-2021-3905 [ 4 ] CVE-2021-36980 https://nvd.nist.gov/vuln/detail/CVE-2021-36980 [ 5 ] CVE-2022-4337 https://nvd.nist.gov/vuln/detail/CVE-2022-4337 [ 6 ] CVE-2022-4338 https://nvd.nist.gov/vuln/detail/CVE-2022-4338 [ 7 ] CVE-2023-1668 https://nvd.nist.gov/vuln/detail/CVE-2023-1668 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202311-16 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2023 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.89

sources: NVD: CVE-2021-3905 // JVNDB: JVNDB-2021-020198 // VULHUB: VHN-400636 // PACKETSTORM: 165634 // PACKETSTORM: 175917

AFFECTED PRODUCTS

vendor:canonicalmodel:ubuntu linuxscope:eqversion:21.10

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:35

Trust: 1.0

vendor:redhatmodel:enterprise linux fast datapathscope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:enterprise linux fast datapathscope:eqversion:8.0

Trust: 1.0

vendor:openvswitchmodel:openvswitchscope:ltversion:2.17.0

Trust: 1.0

vendor:open vswitchmodel:open vswitchscope: - version: -

Trust: 0.8

vendor:レッドハットmodel:red hat enterprise linux fast datapathscope: - version: -

Trust: 0.8

vendor:canonicalmodel:ubuntuscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-020198 // NVD: CVE-2021-3905

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-3905
value: HIGH

Trust: 1.0

NVD: CVE-2021-3905
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202201-1788
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-3905
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-3905
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-020198 // CNNVD: CNNVD-202201-1788 // NVD: CVE-2021-3905

PROBLEMTYPE DATA

problemtype:CWE-401

Trust: 1.1

problemtype:Lack of memory release after expiration (CWE-401) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-400636 // JVNDB: JVNDB-2021-020198 // NVD: CVE-2021-3905

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 165634 // CNNVD: CNNVD-202201-1788

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202201-1788

PATCH

title:Open vSwitch Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=179330

Trust: 0.6

sources: CNNVD: CNNVD-202201-1788

EXTERNAL IDS

db:NVDid:CVE-2021-3905

Trust: 3.5

db:PACKETSTORMid:165634

Trust: 0.8

db:JVNDBid:JVNDB-2021-020198

Trust: 0.8

db:AUSCERTid:ESB-2022.0312

Trust: 0.6

db:CNNVDid:CNNVD-202201-1788

Trust: 0.6

db:VULHUBid:VHN-400636

Trust: 0.1

db:PACKETSTORMid:175917

Trust: 0.1

sources: VULHUB: VHN-400636 // JVNDB: JVNDB-2021-020198 // PACKETSTORM: 165634 // PACKETSTORM: 175917 // CNNVD: CNNVD-202201-1788 // NVD: CVE-2021-3905

REFERENCES

url:https://access.redhat.com/security/cve/cve-2021-3905

Trust: 2.5

url:https://bugzilla.redhat.com/show_bug.cgi?id=2019692

Trust: 2.5

url:https://github.com/openvswitch/ovs-issues/issues/226

Trust: 2.5

url:https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349

Trust: 2.5

url:https://ubuntu.com/security/cve-2021-3905

Trust: 2.5

url:https://security.gentoo.org/glsa/202311-16

Trust: 1.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3905

Trust: 1.0

url:https://www.auscert.org.au/bulletins/esb-2022.0312

Trust: 0.6

url:https://packetstormsecurity.com/files/165634/ubuntu-security-notice-usn-5242-1.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/open-vswitch-overload-via-fragmented-packets-37337

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2021-3905/

Trust: 0.6

url:https://ubuntu.com/security/notices/usn-5242-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/openvswitch/2.16.0-0ubuntu2.1

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-35498

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-4337

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-4338

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-1668

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-36980

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-27827

Trust: 0.1

sources: VULHUB: VHN-400636 // JVNDB: JVNDB-2021-020198 // PACKETSTORM: 165634 // PACKETSTORM: 175917 // CNNVD: CNNVD-202201-1788 // NVD: CVE-2021-3905

CREDITS

Ubuntu

Trust: 0.1

sources: PACKETSTORM: 165634

SOURCES

db:VULHUBid:VHN-400636
db:JVNDBid:JVNDB-2021-020198
db:PACKETSTORMid:165634
db:PACKETSTORMid:175917
db:CNNVDid:CNNVD-202201-1788
db:NVDid:CVE-2021-3905

LAST UPDATE DATE

2024-08-14T12:55:09.990000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-400636date:2022-08-27T00:00:00
db:JVNDBid:JVNDB-2021-020198date:2023-09-27T08:48:00
db:CNNVDid:CNNVD-202201-1788date:2022-08-29T00:00:00
db:NVDid:CVE-2021-3905date:2023-11-26T11:15:08.147

SOURCES RELEASE DATE

db:VULHUBid:VHN-400636date:2022-08-23T00:00:00
db:JVNDBid:JVNDB-2021-020198date:2023-09-27T00:00:00
db:PACKETSTORMid:165634date:2022-01-20T17:49:31
db:PACKETSTORMid:175917date:2023-11-27T15:42:18
db:CNNVDid:CNNVD-202201-1788date:2022-01-20T00:00:00
db:NVDid:CVE-2021-3905date:2022-08-23T16:15:10.177