[Debian] Critical CVE: CVE-2023-41910 lldpd: an out-of-bounds read on heap memory

[Yue Tao]

CVE-2023-41910: https://nvd.nist.gov/vuln/detail/CVE-2023-41910

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

Base Score: Critical

Reference:

lldpd_1.0.11-1+deb11u2
https://www.debian.org/security/2023/dsa-5505
https://www.tenable.com/plugins/nessus/181879

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/integ/+/898082

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/integ/+/898082
Committed: https://opendev.org/starlingx/integ/commit/8bfa85ac23bebebb4c44c37cfecfdef3b1a0ebaf
Submitter: "Zuul (22348)"
Branch: master

commit 8bfa85ac23bebebb4c44c37cfecfdef3b1a0ebaf
Author: Li Zhou <email address hidden>
Date: Fri Oct 6 23:51:15 2023 -0700

    Debian: lldpd: fix CVE-2023-41910

    Upgrade lldpd's version from 1.0.11-1+deb11u1 to 1.0.11-1+deb11u2
    to fix CVE-2023-41910.

    Test Plan:
     Pass: downloader
     Pass: build-pkgs --clean --all
     Pass: build-image
     Pass: boot

    Closes-bug: #2037481

    Signed-off-by: Li Zhou <email address hidden>
    Change-Id: I8ae2cd57ec852e04eb7d067441b17093b46335aa