CVEvulnerability

CVE-2017-14970

5.9 MEDIUM Published 2017-10-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-772

Description

In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor disputes the relevance of this report, stating "it can only be triggered by an OpenFlow controller, but OpenFlow controllers have much more direct and powerful ways to force Open vSwitch to allocate memory, such as by inserting flows into the flow table."

Affected configurations

• openvswitch openvswitch (<= 2.8.0)

Related

Weakness · CWE (1)

  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References