CVE-2015-8011

What it actually does

Buffer overflow in the lldp_decode function triggered by oversized management address TLVs that exceed expected boundaries, enabling memory corruption that can lead to daemon crash or arbitrary code execution.

Why it matters to the business

Systems running vulnerable lldpd versions can be crashed remotely or potentially taken over, disrupting network discovery services and exposing connected infrastructure to further compromise; the flaw affects multiple Linux distributions and has been public for years without widespread exploitation evidence.

How an attack unfolds

An attacker on the same network segment crafts LLDP packets containing large management addresses that violate TLV length boundaries, sending them to a listening lldpd daemon to trigger the overflow in lldp_decode and achieve denial of service or code execution.

How to fix it

Upgrade lldpd to version 0.8.0 or newer on all affected systems; where immediate upgrade is not possible, restrict LLDP reception to trusted interfaces only and monitor daemon stability.

How to confirm the fix worked

Verify installed lldpd version is at least 0.8.0; recompile or run static analysis against the lldp_decode function to confirm boundary checks are present; test with synthetic oversized TLV packets in a lab environment.

Typical attack path

1. Identify hosts running lldpd via network scanning or service discovery
2. Craft malicious LLDP frames with oversized management address TLVs
3. Transmit frames to the target daemon over the local link
4. Trigger buffer overflow leading to crash or shellcode execution

How to detect it

Search system logs and daemon crash reports for unexpected lldpd terminations; inspect network traffic for anomalous LLDP packets with unusually large management address fields; correlate any observed crashes with LLDP source MAC addresses.

What your security team should do

• Prioritize upgrade of lldpd across all production systems to 0.8.0 or later
• Disable LLDP on untrusted network segments until patched
• Add lldpd version checks to configuration management and vulnerability scanning policies
• Review network segmentation to limit LLDP exposure