// For flags

CVE-2020-10722

dpdk: librte_vhost Integer overflow in vhost_user_set_log_base()

Severity Score

6.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

Se encontró una vulnerabilidad en DPDK versiones 18.05 y superiores. Una falta de comprobación en un desbordamiento de enteros en la función vhost_user_set_log_base() podría resultar en un mapa de memoria más pequeño de lo requerido, posiblemente permitiendo una corrupción de la memoria.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-03-20 CVE Reserved
  • 2020-05-18 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Dpdk
Search vendor "Dpdk"
Data Plane Development Kit
Search vendor "Dpdk" for product "Data Plane Development Kit"
<= 18.05
Search vendor "Dpdk" for product "Data Plane Development Kit" and version " <= 18.05"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
18.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
19.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "19.10"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
20.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04"
lts
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
15.1
Search vendor "Opensuse" for product "Leap" and version "15.1"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Border Controller
Search vendor "Oracle" for product "Communications Session Border Controller"
>= 8.2 <= 8.4
Search vendor "Oracle" for product "Communications Session Border Controller" and version " >= 8.2 <= 8.4"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Communications Broker
Search vendor "Oracle" for product "Enterprise Communications Broker"
3.1.0
Search vendor "Oracle" for product "Enterprise Communications Broker" and version "3.1.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Communications Broker
Search vendor "Oracle" for product "Enterprise Communications Broker"
3.2.0
Search vendor "Oracle" for product "Enterprise Communications Broker" and version "3.2.0"
-
Affected