CVE-2017-9214

What it actually does

Buffer over-read triggered by unsigned integer underflow during parsing of an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message in ofputil_pull_queue_get_config_reply10.

Why it matters to the business

Remote attackers can crash the Open vSwitch process or read adjacent memory, disrupting network control plane operations and potentially exposing sensitive packet metadata in environments that rely on the affected packages.

How an attack unfolds

An attacker sends a crafted OFPT_QUEUE_GET_CONFIG_REPLY OpenFlow 1.0 message to a vulnerable Open vSwitch instance; the underflow in message length calculation leads to an out-of-bounds read that can be leveraged for denial of service or limited information disclosure.

How to fix it

Upgrade flux-source-controller (Chainguard) and flux-source-controller (Wolfi) to version 1.1.2-r3 or later; apply any vendor-supplied Open vSwitch patches that correct the queue-config reply parsing logic.

How to confirm the fix worked

Confirm package versions are at or above the stated fixed releases, replay synthetic OFPT_QUEUE_GET_CONFIG_REPLY messages in a lab environment to verify absence of crash or over-read, and review changelog entries for the buffer handling fix.

Typical attack path

1. Identify exposed Open vSwitch control channel or OpenFlow listener
2. Craft and transmit a malicious OFPT_QUEUE_GET_CONFIG_REPLY message with manipulated length fields
3. Trigger unsigned integer underflow in ofputil_pull_queue_get_config_reply10
4. Cause process crash or memory disclosure

How to detect it

Search Open vSwitch logs and system logs for segmentation faults or assertion failures immediately following receipt of OFPT_QUEUE_GET_CONFIG_REPLY messages; correlate with network captures containing OpenFlow 1.0 traffic on control channels.

What your security team should do

• Prioritize upgrade of all flux-source-controller instances to 1.1.2-r3 within standard change windows
• Restrict exposure of OpenFlow control channels to trusted networks only
• Monitor for unexpected Open vSwitch process restarts and queue-config related error logs
• Include the affected packages in regular vulnerability scanning and SBOM reviews