CVE-2021-43612 — Vulnetix

CVE-2021-43612 PUBLISHED CVSS 7.5 HIGH

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

EPSS 0.18% · 38.9th percentile

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.18%

38.9th percentile

Affected Products

Vendor	Product	Versions
fedoraproject	fedora	36, 37, 38
n/a	n/a	n/a
lldpd_project	lldpd	0

Timeline

Apr 15, 2023 CVE Published
Apr 16, 2023 EPSS Score
May 24, 2023 EPSS Score
Jun 30, 2023 EPSS Score
Aug 7, 2023 EPSS Score
Sep 13, 2023 EPSS Score
Oct 21, 2023 EPSS Score
Nov 27, 2023 EPSS Score
Jan 4, 2024 EPSS Score
Mar 19, 2024 EPSS Score
Apr 25, 2024 EPSS Score
Jun 2, 2024 EPSS Score

References

https://lldpd.github.io/security.html url
https://github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7 url
https://github.com/lldpd/lldpd/compare/1.0.12...1.0.13 url
FEDORA-2023-88991d2713 vendor-advisory
FEDORA-2023-c0c184a019 vendor-advisory
FEDORA-2023-3e4feeadec vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43612 advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D url

Open in Interactive Console →