CVE-2021-43612 | Vulnetix

CVE-2021-43612 PUBLISHED CVSS 7.5 HIGH

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

EPSS 1.14% · 65.5th percentile

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

1.14%

65.5th percentile

Affected Products

Vendor	Product	Versions
fedoraproject	fedora	36, 37, 38
n/a	n/a	n/a
lldpd_project	lldpd	0

Timeline

Apr 15, 2023 CVE Published
Apr 16, 2023 EPSS Score
May 24, 2023 EPSS Score
Jul 1, 2023 EPSS Score
Aug 8, 2023 EPSS Score
Sep 16, 2023 EPSS Score
Dec 1, 2023 EPSS Score
Jan 8, 2024 EPSS Score
Feb 15, 2024 EPSS Score
Mar 24, 2024 EPSS Score
May 1, 2024 EPSS Score
Jun 9, 2024 EPSS Score

References

FEDORA-2023-c0c184a019 vendor-advisory
https://lldpd.github.io/security.html url
https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 url
https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13 url
FEDORA-2023-88991d2713 vendor-advisory
FEDORA-2023-3e4feeadec vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43612 advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D url

Open in Interactive Console →