CVSS: 8.6EPSS: 0%CPEs: 14EXPL: 2CVE-2022-2132 – dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
https://notcve.org/view.php?id=CVE-2022-2132
28 Aug 2022 — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK. Se ha encontrado un fallo en la lista de entradas permitidas en DPDK. Este problema permite a un atacante remoto causar una denegación de servicio al enviar un encabezado Vhost diseñado a DPDK The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, o... • https://bugs.dpdk.org/show_bug.cgi?id=1031 • CWE-770: Allocation of Resources Without Limits or Throttling CWE-791: Incomplete Filtering of Special Elements •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3839 – DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash
https://notcve.org/view.php?id=CVE-2021-3839
04 May 2022 — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability. Se ha encontrado un fallo en la biblioteca vhost de DPDK. La función vhost_user_set_inflight_fd() no comprueba "msg-)payload.inflight.num_queues", causando posiblemente una lectura/escritura de memoria fuera de límites. • https://access.redhat.com/security/cve/CVE-2021-3839 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.7EPSS: 0%CPEs: 9EXPL: 0CVE-2020-10723 – dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()
https://notcve.org/view.php?id=CVE-2020-10723
19 May 2020 — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption. Se encontró un problema de corrupción de memoria en DPDK versiones 17.05 y superiores. Este fallo es causado por un truncamiento de enteros en el índice de una carga útil. • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.7EPSS: 0%CPEs: 9EXPL: 0CVE-2020-10722 – dpdk: librte_vhost Integer overflow in vhost_user_set_log_base()
https://notcve.org/view.php?id=CVE-2020-10722
18 May 2020 — A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption. Se encontró una vulnerabilidad en DPDK versiones 18.05 y superiores. Una falta de comprobación en un desbordamiento de enteros en la función vhost_user_set_log_base() podría resultar en un mapa de memoria más pequeño de lo requerido, posiblemente permitiendo una corrupción de la memoria. ovir... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-10724 – dpdk: librte_vhost Missing inputs validation in Vhost-crypto
https://notcve.org/view.php?id=CVE-2020-10724
18 May 2020 — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read. Se encontró una vulnerabilidad en DPDK versiones 18.11 y superiores. Al código de la biblioteca vhost-crypto le falta comprobaciones para los valores suministrados por el usuario, permitiendo potencialmente un filtrado de información mediante una lectura de memoria fuera de límites. Open vSwit... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html • CWE-125: Out-of-bounds Read CWE-190: Integer Overflow or Wraparound •
CVSS: 7.7EPSS: 0%CPEs: 5EXPL: 0CVE-2020-10725 – dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor
https://notcve.org/view.php?id=CVE-2020-10725
18 May 2020 — A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`. Se detectó un fallo en DPDK versión 19.11 y superior, que permite a un invitado malicioso causar un fallo de segmentación de la aplicación ... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html • CWE-665: Improper Initialization •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-10726 – dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS
https://notcve.org/view.php?id=CVE-2020-10726
18 May 2020 — A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service. Se detectó una vulnerabilidad en DPDK versiones 19.11 y superiores. Un contenedor malicioso que presenta acceso directo al socket vhost-user puede seguir enviando mensajes de VHOST_USER_GET_INFLIGHT_FD, causando una filtraci... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html • CWE-190: Integer Overflow or Wraparound CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2019-14818 – dpdk: possible memory leak leads to denial of service
https://notcve.org/view.php?id=CVE-2019-14818
13 Nov 2019 — A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition. Se encontró un fallo en todas las versiones de dpdk 17.xx anteriores a 17.11.8, versiones 16.xx anteriores a 16.11.10, versiones 18.xx anteriore... • https://access.redhat.com/errata/RHSA-2020:0165 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2018-1059 – dpdk: Information exposure in unchecked guest physical to host virtual address translations
https://notcve.org/view.php?id=CVE-2018-1059
24 Apr 2018 — The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable. La interfaz vhost de usuario de DPDK no verifica que el rango físico invitado solicitado esté mapeado y sea contiguo al realizar traducciones de direcciones físicas de invitado a direc... • https://access.redhat.com/errata/RHSA-2018:1267 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •