CVE-2017-9264

Critical

Published: 29/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Open vSwitch (OvS) 2.6.1, there is a buffer over-read issue in the firewall implementation. This occurs while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp`, which can be triggered remotely.

Risk Assessment

An attacker may exploit this vulnerability to remotely trigger errors in the system, potentially leading to unauthorized access or service destabilization.

Recommendation

It is recommended to update Open vSwitch to the latest version to mitigate this vulnerability and to monitor network traffic for potential attack attempts.

Original NVD description (English source)

In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.