Out-of-bounds Write Affecting lldpd-devel package, versions <0:1.0.18-4.el9
Threat Intelligence
EPSS
0.35% (73rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-LLDPDDEVEL-8383555
- published 18 Nov 2024
- disclosed 12 Nov 2024
Introduced: 12 Nov 2024
New CVE-2021-43612 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:9 lldpd-devel to version 0:1.0.18-4.el9 or higher.
This issue was patched in ALSA-2024:9158.
NVD Description
Note: Versions mentioned in the description apply only to the upstream lldpd-devel package and not the lldpd-devel package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:9 relevant fixed versions and status.
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
References
- https://errata.almalinux.org/9/ALSA-2024-9158.html
- https://access.redhat.com/security/cve/CVE-2021-43612
- https://access.redhat.com/errata/RHSA-2024:9158
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/
- https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7
- https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/
- https://lldpd.github.io/security.html
CVSS Scores
version 3.1