Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch)

[Ilya Maximets <i.maximets () ovn org>]

On 12/20/22 22:46, John Helmert III wrote:
> On Tue, Dec 20, 2022 at 10:39:23PM +0100, Ilya Maximets wrote:
> > Description
> > ===========
> >
> > Multiple versions of Open vSwitch are vulnerable to crafted LLDP
> > packets causing denial of service, and data underflow attacks.
> > Triggering the vulnerabilities requires LLDP processing to be enabled
> > for a specific port.  Open vSwitch versions prior to 2.4.0 are not
> > vulnerable.
> >
> > The Common Vulnerabilities and Exposures project (cve.mitre.org)
> > did not assign the identifier to this issue yet.  The identifier will
> > be communicated separately.
>
> Has a CVE been requested?

Yes, CVE was requested via Red Hat.   There was initial communication
but they didn't provide us the identifier yet.

The issue was reported publicly, so we decided to release without waiting.

> > This issue does not affect the `lldpd' project, although they share
> > a code base.  The issue is related to parsing the Auto Attach TLVs,
> > which is specific to the Open vSwitch implementation.
> >
> >
> > Mitigation
> > ==========
> >
> > For any version of Open vSwitch, preventing LLDP packets from reaching
> > Open vSwitch mitigates the vulnerability.  We do not recommend
> > attempting to mitigate the vulnerability this way because of the
> > following difficulties:
> >
> >     - Open vSwitch obtains packets before the iptables host firewall,
> >       so ebtables on the Open vSwitch host cannot ordinarily block the
> >       vulnerability.
> >
> >     - If Open vSwitch is configured to receive and transmit LLDP
> >       messages, the required functionality will need to be disabled
> >       potentially disrupting the network.
> >
> > We have found that Open vSwitch is subject to a denial of service, and
> > possibly a remote code execution exploit when LLDP processing is enabled
> > on an interface.  By default, interfaces are not configured to process
> > LLDP messages.
> >
> >
> > Fix
> > ===
> >
> > Patches to fix these vulnerabilities in Open vSwitch 2.13.x and newer are
> > applied to the appropriate branches, and the original patch is located
> > at:
> >
> >    https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
> >
> > Recommendation
> > ==============
> >
> > We recommend that users of Open vSwitch apply the respective patch, or
> > upgrade to a known patched version of Open vSwitch.  These include:
> >
> > * 3.0.3
> > * 2.17.5
> > * 2.16.6
> > * 2.15.7
> > * 2.14.8
> > * 2.13.10
> >
> >
> > Acknowledgments
> > ===============
> >
> > The Open vSwitch team wishes to thank the reporter:
> >
> >   Qian Chen <cq674350529 () gmail com>