Vulnerability Report

CVE-2023-41910

Title: Lldpd Project Lldpd Memory Corruption

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2023-41910.

CWE Category CWE-125

Published Date Sep 05, 2023

Modified Date Nov 21, 2024

Exploit Status Not Found

Score 9.8 CVSS v3.1

Exploit Probability (EPSS)

0.95%

Vulnerability Summary

CVE-2023-41910: An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

Impacted Vendors

lldpd_project 1

Reference Links

https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b https://github.com/lldpd/lldpd/releases/tag/1.0.17 https://lists.debian.org/debian-lts-announce/2023/09/msg00025.html https://www.debian.org/security/2023/dsa-5505 https://github.com/lldpd/lldpd/commit/a9aeabdf879c25c584852a0bb5523837632f099b https://github.com/lldpd/lldpd/releases/tag/1.0.17 https://lists.debian.org/debian-lts-announce/2023/09/msg00025.html https://www.debian.org/security/2023/dsa-5505

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2023-41910 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

September 05, 2023 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.