CVE-2020-27827: 
NixOS vulnerability analysis and mitigation

A flaw was found in multiple versions of OpenvSwitch where specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The vulnerability was discovered in January 2021 and assigned identifier CVE-2020-27827. The vulnerability affects OpenvSwitch versions after 2.5.x, with LLDP processing enabled on specific ports (OVS Dev).

The vulnerability occurs when LLDP processing is enabled on an interface and the system attempts to allocate data to handle specific optional TLVs from crafted LLDP packets. This can result in memory leaks that eventually lead to resource exhaustion. By default, interfaces are not configured to process LLDP messages. The vulnerability has been assigned a CVSS v3 base score of 7.5 with vector string (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CISA Advisory).

The primary impact of this vulnerability is to system availability, as successful exploitation can cause a denial of service condition through memory resource exhaustion. The vulnerability requires LLDP processing to be enabled on a specific port to be exploitable (OVS Dev).

The vulnerability can be exploited remotely with low attack complexity. No special privileges or user interaction is required. Triggering the vulnerability requires LLDP processing to be enabled for a specific port, which is not enabled by default (CISA Advisory).

The primary mitigation is to update to patched versions of OpenvSwitch, including versions 2.14.1, 2.13.2, 2.12.2, 2.11.5, 2.10.6, 2.9.8, 2.8.10, 2.7.12, and 2.6.9. While preventing LLDP packets from reaching OpenvSwitch can mitigate the vulnerability, this is not recommended as it may disrupt network functionality. Additionally, standard firewall rules may not be effective since OpenvSwitch obtains packets before the iptables host firewall (OVS Dev).