CVE-2021-43612: Buffer Overflow
An out-of-bounds read vulnerability exists due to a boundary error when reading SONMP packets. A remote user can send specially crafted packets to the application, trigger a heap-based buffer overflow read and leak memory values from lldpd application or crash it.
Reference:
https://www.cybersecurity-help.cz/vdb/SB2021111808 https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 https://lldpd.github.io/security.html
Other sources
In lldpd before 1.0.13, when decoding SONMP packets in the sonmpdecode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-43612?
CVE-2021-43612 is a vulnerability in lldpd before version 1.0.13 that allows an out-of-bounds heap read via short SONMP packets.
How severe is CVE-2021-43612?
CVE-2021-43612 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2021-43612?
LLDPD versions up to but excluding 1.0.13 are affected by CVE-2021-43612, as well as Fedora 36, 37, and 38.
How can I fix CVE-2021-43612?
To fix CVE-2021-43612, update lldpd to version 1.0.13 or later. For Fedora, check for updates to the operating system.
Are there any additional resources about CVE-2021-43612?
Yes, you can find additional information about CVE-2021-43612 in the references provided: [Github Commit](https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7), [Github Comparison](https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13), [Fedora Security Announcement](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/).