CVE-2017-9263: Input Validation
In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch.
Other sources
In Open vSwitch while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS attack by a malicious switch.
References:
https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332966.html
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9263?
CVE-2017-9263 is classified as a potential remote denial of service (DoS) vulnerability.
How do I fix CVE-2017-9263?
To mitigate CVE-2017-9263, upgrade Open vSwitch to a version later than 2.7.0 that addresses this vulnerability.
Who is affected by CVE-2017-9263?
Open vSwitch version 2.7.0 is specifically affected by CVE-2017-9263.
What type of attack does CVE-2017-9263 enable?
CVE-2017-9263 can be exploited to perform a remote denial of service attack.
What component in Open vSwitch is impacted by CVE-2017-9263?
The `ofp_print_role_status_message` function in `lib/ofp-print.c` is impacted by CVE-2017-9263.