CVE-2022-32166: ovs - buffer over-read

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-28 · updated 2026-06-17
Weakness: CWE-125

Description

In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

Affected products

Cloudbase Open Vswitch: from 0.90.0 through 2.5.0
Debian Linux: 10.0

References

https://github.com/cloudbase/ovs/commit/2ed6505555cdcb46f9b1f0329d1491b75290fc73
https://lists.debian.org/debian-lts-announce/2022/10/msg00036.html
https://www.mend.io/vulnerability-database/CVE-2022-32166
https://github.com/cloudbase/ovs/commit/2ed6505555cdcb46f9b1f0329d1491b75290fc73
https://lists.debian.org/debian-lts-announce/2022/10/msg00036.html
https://www.mend.io/vulnerability-database/CVE-2022-32166

Get alerted when CVE-2022-32166 or the next vulnerability affects your stack