CVE-2022-4338: Integer Underflow
First published: Tue Jan 10 2023(Updated: )
An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openvswitch Openvswitch | <2.13.10 | |
| Openvswitch Openvswitch | >=2.14.0<2.14.8 | |
| Openvswitch Openvswitch | >=2.15.0<2.15.7 | |
| Openvswitch Openvswitch | >=2.16.0<2.16.6 | |
| Openvswitch Openvswitch | >=2.17.0<2.17.5 | |
| Openvswitch Openvswitch | >=3.0.0<3.0.3 | |
| Debian Debian Linux | =11.0 | |
| debian/openvswitch | <=2.10.7+ds1-0+deb10u1 | 2.10.7+ds1-0+deb10u4 2.15.0+ds1-2+deb11u4 3.1.0-2 3.2.2~git20231029-2 |
| <2.13.10 | ||
| >=2.14.0<2.14.8 | ||
| >=2.15.0<2.15.7 | ||
| >=2.16.0<2.16.6 | ||
| >=2.17.0<2.17.5 | ||
| >=3.0.0<3.0.3 | ||
| =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/openvswitch/ovs/pull/405
- https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html
- https://www.debian.org/security/2023/dsa-5319
- https://www.openwall.com/lists/oss-security/2022/12/21/4
- https://www.openwall.com/lists/oss-security/2022/12/20/2
- https://github.com/openvswitch/ovs/commit/be53a5c447c3ed77ef2d4e1e09ea63de576b90e8
- https://github.com/openvswitch/ovs/commit/7490f281f09a8455c48e19b0cf1b99ab758ee4f4
- https://security-tracker.debian.org/tracker/CVE-2022-4338
- https://security.gentoo.org/glsa/202311-16
Frequently Asked Questions
What is CVE-2022-4338?
CVE-2022-4338 is an integer underflow vulnerability in Organization Specific TLV in various versions of OpenvSwitch.
Which versions of OpenvSwitch are affected by CVE-2022-4338?
Various versions of OpenvSwitch including 2.13.10 up to but excluding 2.14.8, 2.15.7 up to but excluding 2.16.6, 2.17.5 up to but excluding 3.0.3 are affected by CVE-2022-4338.
How severe is CVE-2022-4338?
CVE-2022-4338 has a severity score of 9.8, which is considered critical.
How can I fix CVE-2022-4338?
To fix CVE-2022-4338, you should update OpenvSwitch to version 2.10.7+ds1-0+deb10u4, 2.15.0+ds1-2+deb11u4, 3.1.0-2, or 3.2.0-2.
Where can I find more information about CVE-2022-4338?
You can find more information about CVE-2022-4338 in the following references: [GitHub Pull Request](https://github.com/openvswitch/ovs/pull/405), [OpenvSwitch Mailing List](https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html), [Debian Security Advisory](https://www.debian.org/security/2023/dsa-5319).
- collector/nvd-index
- collector/security-tracker-debian
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/openvswitch
- canonical/openvswitch openvswitch
- version/openvswitch openvswitch/2.14.0
- version/openvswitch openvswitch/2.15.0
- version/openvswitch openvswitch/2.16.0
- version/openvswitch openvswitch/2.17.0
- version/openvswitch openvswitch/3.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- package-manager/debian