CVE-2023-41910
Fixed in a distro release EPSS 1%
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
Products: lldpd_project lldpd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | lldpd | 1.0.18-4.el9 |
| AlmaLinux 9 | lldpd-devel | 1.0.18-4.el9 |
| Debian 10 | lldpd | 1.0.3-1+deb10u2 |
| Debian 11 | lldpd | 1.0.11-1+deb11u2 |
| Debian 12 | lldpd | 1.0.16-1+deb12u1 |
| Debian 13 | lldpd | 1.0.17-1 |
| Debian 14 | lldpd | 1.0.17-1 |
| Red Hat Enterprise Linux 9 | lldpd | 0:1.0.18-4.el9 |
| Red Hat Enterprise Linux 9 | lldpd-debuginfo | 0:1.0.18-4.el9 |
| Red Hat Enterprise Linux 9 | lldpd-debugsource | 0:1.0.18-4.el9 |
| Red Hat Enterprise Linux 9 | lldpd-devel | 0:1.0.18-4.el9 |
| Rocky Linux 9 | lldpd | 0:1.0.18-4.el9 |
| Ubuntu 16.04 LTS | lldpd | no fix |
| Ubuntu 18.04 LTS | lldpd | no fix |
| Ubuntu 20.04 LTS | lldpd | no fix |
| Ubuntu 22.04 LTS | lldpd | no fix |