Bug 1222508 (CVE-2024-2169)

Summary:	VUL-0: CVE-2024-2169: TRACKERBUG: udp: Implementations of UDP protocol are vulnerable to network loops
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner, thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/400061/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-2169:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-09 07:36:31 UTC

Implementations of UDP application protocol are vulnerable to network loops.   An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.

https://kb.cert.org/vuls/id/417980
https://www.kb.cert.org/vuls/id/417980

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2169
https://bugzilla.redhat.com/show_bug.cgi?id=2272753

Comment 1 Thomas Leroy 2024-04-09 07:39:47 UTC

The report only lists commercial vendors as affected, so nothing to do at the moment.
Leaving open if open-source implementations are revealed affected in the future.