CVE-2017-9263

MEDIUM

Open vSwitch 2.7.0 - DoS

Title source: llm

Description

In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.

References (8)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2418

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2553

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2648

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2665

[Mailing List, Patch, Vendor Advisory] https://mail.openvswitch.org/pipermail/ovs-dev/2017-May/332966.html

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2692

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2698

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2017:2727

Scores

CVSS v3 6.5

EPSS 0.0025

EPSS Percentile 47.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20

Status published

Products (2)

openvswitch/openvswitch

n/a/n/a

Published May 29, 2017

Tracked Since Feb 18, 2026