title: ovs - buffer over-read
description: In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
problem types: CWE-125 Out-of-bounds Read
affected:
{
vendor: ovs
product: ovs
versions:
version: v0.90.0, status: affected, lessThan: unspecified, versionType: custom
version: unspecified, lessThanOrEqual: v2.5.0, status: affected, versionType: custom
}
metrics:
other: [
type: unknown
content: {'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'attackComplexity': 'LOW', 'attackVector': 'NETWORK', 'availabilityImpact': 'HIGH', 'confidentialityImpact': 'HIGH', 'integrityImpact': 'HIGH', 'privilegesRequired': 'LOW', 'scope': 'UNCHANGED', 'userInteraction': 'NONE', 'version': 3.1, 'baseScore': 8.8, 'baseSeverity': 'HIGH'}
]
solutions: Update version to v2.5.1 or later