CVE-2022-4337: 
NixOS vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2022-4337) was discovered in various versions of OpenvSwitch's LLDP implementation. The vulnerability was introduced in version 2.4.0 and affects the Organization Specific TLV processing when LLDP is enabled for a specific port (CVE Mitre, OpenWall).

The vulnerability exists in the LLDP implementation's Auto-Attach standard support, specifically in the parsing of LLDP_TLV_AA_ELEMENT_SUBTYPE and LLDP_TLV_AA_ISID_VLAN_ASGNS_SUBTYPE elements. The issue occurs due to improper length checks for these TLVs, which can lead to an out-of-bounds read of memory when processing malformed LLDP packets (GitHub PR, OVS Dev).

When exploited, this vulnerability could result in denial of service and potentially lead to undefined behavior, including system crashes. The impact is limited to systems where LLDP processing is enabled on specific ports (OpenWall).

The vulnerability has been fixed in multiple versions including 3.0.3, 2.17.5, 2.16.6, 2.15.7, 2.14.8, and 2.13.10. Users are recommended to upgrade to these patched versions. While disabling LLDP packet processing can mitigate the vulnerability, this is not recommended as it may disrupt network functionality (OpenWall).