CVE-2022-32166
Assigner: Mend
Published: 2022-06-01T00:00:00
State: PUBLISHED
title: ovs - buffer over-read
datePublic: 2022-06-01T00:00:00
descriptions: value: In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
affected: vendor: ovs
product: ovs
versions: version: v0.90.0
status: affected
lessThan: unspecified
versionType: custom
version: unspecified
lessThanOrEqual: v2.5.0
status: affected
versionType: custom
credits: value: Mend Vulnerability Research Team (MVR)
metrics: other: type: unknown
content: vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
version: 3.1
baseScore: 8.8
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-125 Out-of-bounds Read
cweId: CWE-125
x_generator: engine: Vulnogram 0.0.9
source: advisory: https://www.mend.io/vulnerability-database/
discovery: UNKNOWN
solutions: value: Update version to v2.5.1 or later