CVE-2017-9214: Integer Underflow
A vulnerability in openvswitch was found. While parsing an OFPTQUEUEGETCONFIGREPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function ofputilpullqueuegetconfigreply10 in lib/ofp-util.c.
References:
https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332711.html
Other sources
In Open vSwitch (OvS) 2.7.0, while parsing an OFPTQUEUEGETCONFIGREPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function ofputilpullqueuegetconfigreply10 in lib/ofp-util.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9214?
CVE-2017-9214 is considered to have a high severity due to its potential for buffer over-read, which could lead to application crashes or information leaks.
How do I fix CVE-2017-9214?
To fix CVE-2017-9214, you should update Open vSwitch to the latest version that contains the security patch for this vulnerability.
What software is affected by CVE-2017-9214?
CVE-2017-9214 affects Open vSwitch versions 2.7.0 and various versions of Red Hat OpenStack and Red Hat Enterprise Virtualization.
Is CVE-2017-9214 exploitable remotely?
Yes, CVE-2017-9214 can be potentially exploited remotely if an attacker can send crafted OFP messages to the affected Open vSwitch instance.
What type of vulnerability is CVE-2017-9214?
CVE-2017-9214 is classified as a buffer over-read vulnerability resulting from an unsigned integer underflow.