CVE-2021-36980: Use After Free

Published Feb 23, 2021
·
Updated

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decodeNXASTRAWENCAP (called from ofpactdecode and ofpactsdecode) during the decoding of a RAWENCAP action.

Other sources

Open vSwitch (aka openvswitch) has a use-after-free in decodeNXASTRAWENCAP (called from ofpactdecode and ofpactsdecode) during the decoding of a RAWENCAP action.

Affected Software

20 affected componentsFixes available
redhat/openvswitch2.11<0:2.11.3-89.el7fd
0:2.11.3-89.el7fd
redhat/openvswitch2.13<0:2.13.0-102.el7fd
0:2.13.0-102.el7fd
redhat/openvswitch2.11<0:2.11.3-86.el8fd
0:2.11.3-86.el8fd
redhat/openvswitch2.13<0:2.13.0-114.el8fd
0:2.13.0-114.el8fd
redhat/openvswitch2.15<0:2.15.0-24.el8fd
0:2.15.0-24.el8fd
redhat/openvswitch2.15<0:2.15.0-28.el8fd
0:2.15.0-28.el8fd
redhat/openvsiwtch<2.13.4
2.13.4
redhat/openvswitch<2.15.1
2.15.1
Openvswitch OpenvSwitch>=2.11.0<=2.15.0
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2
alpine/openvswitch>=2.11.0<2.12.3-r2
2.12.3-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/openvswitch2.11 to a version that resolves this vulnerability.

    Fixed in 0:2.11.3-89.el7fd
  2. Upgrade

    Upgrade redhat/openvswitch2.13 to a version that resolves this vulnerability.

    Fixed in 0:2.13.0-102.el7fd
  3. Upgrade

    Upgrade redhat/openvswitch2.11 to a version that resolves this vulnerability.

    Fixed in 0:2.11.3-86.el8fd
  4. Upgrade

    Upgrade redhat/openvswitch2.13 to a version that resolves this vulnerability.

    Fixed in 0:2.13.0-114.el8fd
  5. Upgrade

    Upgrade redhat/openvswitch2.15 to a version that resolves this vulnerability.

    Fixed in 0:2.15.0-24.el8fd
  6. Upgrade

    Upgrade redhat/openvswitch2.15 to a version that resolves this vulnerability.

    Fixed in 0:2.15.0-28.el8fd
  7. Upgrade

    Upgrade redhat/openvsiwtch to a version that resolves this vulnerability.

    Fixed in 2.13.4
  8. Upgrade

    Upgrade redhat/openvswitch to a version that resolves this vulnerability.

    Fixed in 2.15.1
  9. Upgrade

    Upgrade alpine/openvswitch to a version that resolves this vulnerability.

    Fixed in 2.12.3-r2
  10. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 38744b1bcb022c611712527f039722115300f58f
  11. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 65c61b0c23a0d474696d7b1cea522a5016a8aeb3
  12. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 6d67310f4d2524b466b98f05ebccc1add1e8cf35
  13. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 77cccc74deede443e8b9102299efc869a52b65b2
  14. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 8ce8dc34b5f73b30ce0c1869af9947013c3c6575
  15. Upgrade

    Upgrade openvswitch to a version that resolves this vulnerability.

    Patch 9926637a80d0d243dbf9c49761046895e9d1a8e2

Event History

Feb 23, 2021
CVE Published
12:00 AM
Jul 20, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·07:15 AM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2021-36980?

CVE-2021-36980 is a vulnerability in Open vSwitch (aka openvswitch) that allows for a use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action.

2

What is the severity of CVE-2021-36980?

The severity of CVE-2021-36980 is high with a CVSS score of 7.5.

3

Which software versions are affected by CVE-2021-36980?

Open vSwitch versions 2.11.0 through 2.15.0 are affected by CVE-2021-36980.

4

How can I fix CVE-2021-36980?

To fix CVE-2021-36980, you need to update Open vSwitch to version 2.13.4 if you are using version 2.11.0 to 2.13.0, or to version 2.15.1 if you are using version 2.15.0.

5

Where can I find more information about CVE-2021-36980?

You can find more information about CVE-2021-36980 in the referenced links: [link1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851), [link2](https://github.com/openvswitch/ovs/commit/77cccc74deede443e8b9102299efc869a52b65b2), [link3](https://github.com/openvswitch/ovs/commit/65c61b0c23a0d474696d7b1cea522a5016a8aeb3).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203