Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 918552 (CVE-2023-41910) - <net-misc/lldpd-1.0.17: out of bounds read
Summary: <net-misc/lldpd-1.0.17: out of bounds read
Status: RESOLVED FIXED
Alias: CVE-2023-41910
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/lldpd/lldpd/releas...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on: 918553
Blocks:
  Show dependency tree
 
Reported: 2023-11-25 19:41 UTC by John Helmert III
Modified: 2024-07-18 06:06 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-11-25 19:41:40 UTC 
CVE-2023-41910:

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

Please stabilize 1.0.17.
Comment 1 Pacho Ramos gentoo-dev 2024-06-05 13:24:34 UTC 
It seems 1.0.16 is not stable, cleaning the old version would be enough then, I think
Comment 2 Hans de Graaff gentoo-dev Security 2024-07-17 06:16:57 UTC 
(In reply to Pacho Ramos from comment #1)
> It seems 1.0.16 is not stable, cleaning the old version would be enough
> then, I think

Yes, I've adjusted the whiteboard status accordingly (for a package without any stable versions).
Comment 3 Larry the Git Cow gentoo-dev 2024-07-17 18:05:08 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84cd129314ac47a9631049caae75f8f45c550366

commit 84cd129314ac47a9631049caae75f8f45c550366
Author:     Patrick McLean <chutzpah@gentoo.org>
AuthorDate: 2024-07-17 18:04:52 +0000
Commit:     Patrick McLean <chutzpah@gentoo.org>
CommitDate: 2024-07-17 18:04:52 +0000

    net-misc/lldpd: drop 1.0.16-r2, 1.0.17
    
    Bug: https://bugs.gentoo.org/918552
    Signed-off-by: Patrick McLean <chutzpah@gentoo.org>

 net-misc/lldpd/Manifest                            |   2 -
 .../files/lldpd-1.0.16-configure-clang16.patch     |  23 -----
 net-misc/lldpd/lldpd-1.0.16-r2.ebuild              | 114 ---------------------
 net-misc/lldpd/lldpd-1.0.17.ebuild                 | 111 --------------------
 4 files changed, 250 deletions(-)