CVE-2024-22563: 
NixOS vulnerability analysis and mitigation

OpenVSwitch version 2.17.8 was discovered to contain a memory leak vulnerability (CVE-2024-22563) in the function xmalloc__ located in openvswitch-2.17.8/lib/util.c. The vulnerability was disclosed on January 19, 2024, and affects the OpenVSwitch networking software (NVD).

The vulnerability is classified with a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is categorized as CWE-401 (Missing Release of Memory after Effective Lifetime). The memory leak occurs specifically in the ovs_pcap_open function where memory is allocated for the 'p_file' structure but not released when fopen fails (OpenSUSE Patch).

The vulnerability results in a memory leak condition that could potentially lead to resource exhaustion and system performance degradation over time. The high CVSS score of 7.5 indicates significant potential impact on system availability (NVD).

Fixed versions have been released for various distributions including Debian Bullseye (2.15.0+ds1-2+deb11u5), Bookworm (3.1.0-2+deb12u1), and Sid/Trixie (3.5.0-1). Users are advised to upgrade to these patched versions (Debian Tracker).