CVE-2017-9214 in vSwitch

Summary

In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Reservation: 05/23/2017
• Disclosure: 05/23/2017
• Moderation: VulDB entry created
• Entries: VDB-101737
• CPE: ready
• CWE: CWE-191 (Confirmed)
• CVSS: 8.5
• EPSS: 0.03390
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2017-9214
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-9214
• CVE Details: https://www.cvedetails.com/cve/CVE-2017-9214/