An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDPTLVADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdpdecode in daemon/protocols/cdp.c.

A buffer overflow was found in the lldpdecode function in daemon/protocols/lldp.c in lldpd. This flaw allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries. This threatens the system's confidentiality, integrity, and availability.

A flaw was found in multiple versions of Open vSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.

An out-of-bounds read vulnerability exists due to a boundary error when reading SONMP packets. A remote user can send specially crafted packets to the application, trigger a heap-based buffer overflow read and leak memory values from lldpd application or crash it.

Reference:

https://www.cybersecurity-help.cz/vdb/SB2021111808 https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 https://lldpd.github.io/security.html

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpddecode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 ETHERADDRLEN but should be s - 2 ETHERADDRLEN - 4, causing a 4-byte heap buffer over-read past the malloc(hmtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.