Description
A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | lldp/openvswitch | lldpd 1.0.8, openvswitch 2.14.1, openvswitch 2.13.2, openvswitch 2.12.2, openvswitch 2.11.5, openvswitch 2.10.6, openvswitch 2.9.8, openvswitch 2.8.10, openvswitch 2.7.12, openvswitch 2.6.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lldpd | 1.0.8-1 | — |
| Debian 14 | openvswitch | 2.15.0~git20210104.def6eb1ea+dfsg1-4 | — |
| Debian 13 | lldpd | 1.0.8-1 | — |
| Debian 13 | openvswitch | 2.15.0~git20210104.def6eb1ea+dfsg1-4 | — |
| Debian 12 | lldpd | 1.0.8-1 | — |
| Debian 12 | openvswitch | 2.15.0~git20210104.def6eb1ea+dfsg1-4 | — |
| Debian 10 | lldpd | 1.0.3-1+deb10u1 | DLA-3389-1 |
| Debian 10 | openvswitch | 2.10.6+ds1-0+deb10u1 | DSA-4836-1 |
| Debian 9 | openvswitch | 2.6.10-0+deb9u1 | DLA-2571-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lldpd | No fix yet | — |
| Ubuntu 26.04 LTS | lldpd | No fix yet | — |
| Ubuntu 25.10 | lldpd | No fix yet | — |
| Ubuntu 24.04 LTS | lldpd | No fix yet | — |
| Ubuntu 22.04 LTS | lldpd | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | lldpd | No fix yet | — |
| Ubuntu 20.04 LTS | openvswitch | 2.13.1-0ubuntu0.20.04.3 | USN-4691-1 |
| Ubuntu 18.04 LTS | lldpd | No fix yet | — |
| Ubuntu 18.04 LTS | openvswitch | 2.9.7-0ubuntu0.18.04.2 | USN-4691-1 |
| Ubuntu 16.04 LTS | lldpd | No fix yet | — |
| Ubuntu 16.04 LTS | openvswitch | 2.5.9-0ubuntu0.16.04.2 | USN-4691-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | lldpd +1 | 1.0.18-4.el9 | RHSA-2024:9158 |
| RHEL 8 | openvswitch2.11 +4 | 2.11.3-83.el8fdp | RHSA-2021:0837 |
| RHEL 8 | openvswitch2.13 +5 | 2.13.0-79.5.el8fdp | RHSA-2021:0497 |
| RHEL 7 | openvswitch +3 | 2.9.9-1.el7fdp | RHSA-2021:2077 |
| RHEL 7 | openvswitch2.11 +3 | 2.11.3-86.el7fdp | RHSA-2021:1050, RHSA-2021:0834 |
| RHEL 7 | openvswitch2.13 +4 | 2.13.0-81.el7fdp | RHSA-2021:0835 |
| RHEL 7 | ovn2.11 +2 | 2.11.1-57.el7fdp | RHSA-2021:1050 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.14-20210322.0.el7_9 | RHSA-2021:1051 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.4.4-20210307.0.el8_3 | RHSA-2021:0976 |
| Red Hat OpenStack 13 | openvswitch2.11 +3 | 2.11.3-86.el7fdp | RHSA-2021:2456 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | lldpd +1 | 1.0.18-4.el9 | ALSA-2024:9158 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | lldpd | 1.0.18-4.el9 | RLSA-2024:9158 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1, SUSE-SU-2021:0258-1 |
| SLES 15 SP1 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SLES 15 | openvswitch | 2.11.5-6.30.2 | SUSE-SU-2021:0277-1 |
| SLES 12 SP5 | openvswitch | 2.11.5-3.3.2 | SUSE-SU-2021:0276-1 |
| SLES 12 SP4 | openvswitch | 2.8.10-4.23.1 | SUSE-SU-2021:0297-1 |
Show 21 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
| SLES 12 SP2 | openvswitch +1 | 2.5.11-25.26.1 | SUSE-SU-2021:0298-1 |
| SLES for SAP 15 SP1 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SLES for SAP 15 | openvswitch | 2.11.5-6.30.2 | SUSE-SU-2021:0277-1 |
| SLES for SAP 12 SP5 | openvswitch | 2.11.5-3.3.2 | SUSE-SU-2021:0276-1 |
| SLES for SAP 12 SP4 | openvswitch | 2.8.10-4.23.1 | SUSE-SU-2021:0297-1 |
| SLES for SAP 12 SP3 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
| SLES for SAP 12 SP2 | openvswitch +1 | 2.5.11-25.26.1 | SUSE-SU-2021:0298-1 |
| SLE HPC 15 SP1 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SLE HPC 15 | openvswitch | 2.11.5-6.30.2 | SUSE-SU-2021:0277-1 |
| SUSE OpenStack Cloud Crowbar 9 | openvswitch | 2.8.10-4.23.1 | SUSE-SU-2021:0297-1 |
| SUSE OpenStack Cloud Crowbar 8 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
| SUSE OpenStack Cloud 9 | openvswitch | 2.8.10-4.23.1 | SUSE-SU-2021:0297-1 |
| SUSE OpenStack Cloud 8 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
| SUSE OpenStack Cloud 7 | openvswitch +1 | 2.5.11-25.26.1 | SUSE-SU-2021:0298-1 |
| SUSE Manager Server 4.0 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SUSE Manager Retail Branch Server 4.0 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SUSE Manager Proxy 4.0 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SUSE HPE Helion OpenStack 8 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
| SUSE Enterprise Storage 6 | openvswitch | 2.11.5-3.12.1 | SUSE-SU-2021:0300-1 |
| SUSE Enterprise Storage 5 | openvswitch | 2.7.12-3.36.1 | SUSE-SU-2021:0284-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openvswitch | 2.14.2-11.3 | openSUSE-SU-2024:11129-1 |
| openSUSE Leap 15.2 | openvswitch | 2.13.2-lp152.3.9.1 | openSUSE-SU-2021:0239-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | lldpd | 1.0.8-r0 | — |
| Alpine v3.24 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.23 | lldpd | 1.0.8-r0 | — |
| Alpine v3.23 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.22 | lldpd | 1.0.8-r0 | — |
| Alpine v3.22 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.21 | lldpd | 1.0.8-r0 | — |
| Alpine v3.21 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.20 | lldpd | 1.0.8-r0 | — |
| Alpine v3.20 | openvswitch | 2.12.2-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | lldpd | 1.0.8-r0 | — |
| Alpine v3.19 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.18 | lldpd | 1.0.8-r0 | — |
| Alpine v3.18 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.17 | lldpd | 1.0.8-r0 | — |
| Alpine v3.17 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.16 | lldpd | 1.0.8-r0 | — |
| Alpine v3.16 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.15 | lldpd | 1.0.8-r0 | — |
| Alpine v3.15 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.14 | lldpd | 1.0.8-r0 | — |
| Alpine v3.14 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.13 | lldpd | 1.0.8-r0 | — |
| Alpine v3.13 | openvswitch | 2.12.2-r0 | — |
| Alpine v3.12 | lldpd | 1.0.8-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | lldpd | 1.0.14-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | lldpd +1 | 1.0.18-4.el9 | ELSA-2024-9158 |
Advisories 29
- ALSA-2024:9158 Moderate: lldpd security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:9158 Red Hat Security Advisory: lldpd security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:2456 Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (openvswitch2.11) security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:2077 Red Hat Security Advisory: openvswitch security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:1051 Red Hat Security Advisory: RHV-H enhancement and security update (redhat-virtualization-host) 4.3.14 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:0976 Red Hat Security Advisory: Red Hat Virtualization Host security, bug fix and enhancement update (4.4.4-2) Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:1050 Red Hat Security Advisory: openvswitch2.11 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:0835 Red Hat Security Advisory: openvswitch2.13 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:0837 Red Hat Security Advisory: openvswitch2.11 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:0834 Red Hat Security Advisory: openvswitch2.11 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2021:0497 Red Hat Security Advisory: openvswitch2.13 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- USN-4691-1 openvswitch vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4836-1 openvswitch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3389-1 lldpd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2571-1 openvswitch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:9158 Moderate: lldpd security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2021:0298-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0300-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0297-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0258-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0239-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0276-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0284-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0277-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11129-1 libopenvswitch-2_14-0-2.14.2-11.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2024-9158 Moderate: lldpd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
- WID-SEC-2023-0916 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 11, 2024
- ICSA-21-194-07 Siemens Industrial Products LLDP (Update D) CISA ICS & IT advisories · Mar 14, 2023
- SSA-941426 SSA-941426: Multiple LLDP Vulnerabilities in Industrial Products Siemens ProductCERT · Mar 14, 2023
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1921438
- https://mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
- FEDORA-2023-88991d2713 vendor-advisory
- FEDORA-2023-c0c184a019 vendor-advisory
- FEDORA-2023-3e4feeadec vendor-advisory
- GLSA-202311-16 vendor-advisory