CVE-2016-2074
CriticalSummary
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to upgrade Open vSwitch to version 2.3.3 or 2.4.1 to mitigate this vulnerability.
Other vulnerabilities in Open vSwitch
See all- CVE-2016-10377High
In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in the `miniflow_extract` function, permitting remote bypass of the access control list enforced by the switch.
- CVE-2017-9264Critical
In Open vSwitch (OvS) 2.6.1, there is a buffer over-read issue in the firewall implementation. This occurs while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp`, which can be triggered remotely.
- CVE-2026-36499Medium
A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads, causing a denial of service (DoS) via resource exhaustion.
- CVE-2026-34956Medium
A flaw was found in Open vSwitch. When configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in Denial of Service (DoS).
Original NVD description (English source)
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.