Search criteria

10 vulnerabilities found for enterprise_linux_fast_datapath by redhat

CVE-2022-2132 (GCVE-0-2022-2132)

Vulnerability from nvd – Published: 2022-08-31 15:32 – Updated: 2024-08-03 00:24
VLAI?
Summary
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
Severity ?
No CVSS data available.
CWE
  • CWE-791 - >CWE-183->CWE-641->CWE-770
Assigner
Impacted products
Vendor Product Version
n/a dpdk Affected: dpdk 21.11, dpdk 20.11, dpdk 19.11
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
          },
          {
            "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "dpdk 21.11, dpdk 20.11, dpdk 19.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-791",
              "description": "CWE-791-\u003eCWE-183-\u003eCWE-641-\u003eCWE-770",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-02T06:06:28.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
        },
        {
          "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2022-2132",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "dpdk",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "dpdk 21.11, dpdk 20.11, dpdk 19.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-791-\u003eCWE-183-\u003eCWE-641-\u003eCWE-770"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
            },
            {
              "name": "https://bugs.dpdk.org/show_bug.cgi?id=1031",
              "refsource": "MISC",
              "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
            },
            {
              "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-2132",
    "datePublished": "2022-08-31T15:32:58.000Z",
    "dateReserved": "2022-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:24:44.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3905 (GCVE-0-2021-3905)

Vulnerability from nvd – Published: 2022-08-23 00:00 – Updated: 2024-08-03 17:09
VLAI?
Summary
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Severity ?
No CVSS data available.
CWE
  • CWE-401 - - Missing Release of Memory after Effective Lifetime
Assigner
Impacted products
Vendor Product Version
n/a openvswitch (ovs) Affected: Fixed in v2.17.0
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019692"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-3905"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2021-3905"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openvswitch/ovs-issues/issues/226"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349"
          },
          {
            "name": "GLSA-202311-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-16"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openvswitch (ovs)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in v2.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 - Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-26T11:06:13.552Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019692"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-3905"
        },
        {
          "url": "https://ubuntu.com/security/CVE-2021-3905"
        },
        {
          "url": "https://github.com/openvswitch/ovs-issues/issues/226"
        },
        {
          "url": "https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349"
        },
        {
          "name": "GLSA-202311-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202311-16"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3905",
    "datePublished": "2022-08-23T00:00:00.000Z",
    "dateReserved": "2021-10-26T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3839 (GCVE-0-2021-3839)

Vulnerability from nvd – Published: 2022-08-23 15:52 – Updated: 2024-08-03 17:09
VLAI?
Summary
A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Severity ?
No CVSS data available.
CWE
  • CWE-125 - - Out-of-bounds Read | CWE-787 - Out-of-bounds Write
Assigner
Impacted products
Vendor Product Version
n/a dpdk Affected: Fixed in dpdk v22.03
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in dpdk v22.03"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg-\u003epayload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 - Out-of-bounds Read | CWE-787 - Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-23T15:52:42.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3839",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "dpdk",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in dpdk v22.03"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg-\u003epayload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125 - Out-of-bounds Read | CWE-787 - Out-of-bounds Write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
            },
            {
              "name": "https://access.redhat.com/security/cve/CVE-2021-3839",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
            },
            {
              "name": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5",
              "refsource": "MISC",
              "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3839",
    "datePublished": "2022-08-23T15:52:42.000Z",
    "dateReserved": "2021-09-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14818 (GCVE-0-2019-14818)

Vulnerability from nvd – Published: 2019-11-14 00:00 – Updated: 2024-08-05 00:26
VLAI?
Summary
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
CWE
Assigner
Impacted products
Vendor Product Version
DPDK dpdk Affected: all dpdk version 17.x.x before 17.11.8
Affected: all dpdk version 16.x.x before 16.11.10
Affected: all dpdk version 18.x.x before 18.11.4
Affected: all dpdk version 19.x.x before 19.08.1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:26:39.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2019-019df9a459",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/"
          },
          {
            "name": "RHSA-2020:0166",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0166"
          },
          {
            "name": "RHSA-2020:0165",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0165"
          },
          {
            "name": "RHSA-2020:0168",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0168"
          },
          {
            "name": "RHSA-2020:0172",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0172"
          },
          {
            "name": "RHSA-2020:0171",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0171"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.dpdk.org/show_bug.cgi?id=363"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "DPDK",
          "versions": [
            {
              "status": "affected",
              "version": "all dpdk version 17.x.x before 17.11.8"
            },
            {
              "status": "affected",
              "version": "all dpdk version 16.x.x before 16.11.10"
            },
            {
              "status": "affected",
              "version": "all dpdk version 18.x.x before 18.11.4"
            },
            {
              "status": "affected",
              "version": "all dpdk version 19.x.x before 19.08.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2019-019df9a459",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/"
        },
        {
          "name": "RHSA-2020:0166",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0166"
        },
        {
          "name": "RHSA-2020:0165",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0165"
        },
        {
          "name": "RHSA-2020:0168",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0168"
        },
        {
          "name": "RHSA-2020:0172",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0172"
        },
        {
          "name": "RHSA-2020:0171",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0171"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818"
        },
        {
          "url": "https://bugs.dpdk.org/show_bug.cgi?id=363"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-14818",
    "datePublished": "2019-11-14T00:00:00.000Z",
    "dateReserved": "2019-08-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:26:39.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1059 (GCVE-0-2018-1059)

Vulnerability from nvd – Published: 2018-04-24 18:00 – Updated: 2024-09-17 00:46
VLAI?
Summary
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Severity ?
No CVSS data available.
CWE
Assigner
References
https://access.redhat.com/errata/RHSA-2018:2524 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2102 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/cve-2018-1059 x_refsource_MISC
https://usn.ubuntu.com/3642-2/ vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:2038 vendor-advisoryx_refsource_REDHAT
https://usn.ubuntu.com/3642-1/ vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:1267 vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1544298 x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat, Inc. DPDK Affected: before 18.02.1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:44:11.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:2524",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2524"
          },
          {
            "name": "RHSA-2018:2102",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2102"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2018-1059"
          },
          {
            "name": "USN-3642-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3642-2/"
          },
          {
            "name": "RHSA-2018:2038",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2038"
          },
          {
            "name": "USN-3642-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3642-1/"
          },
          {
            "name": "RHSA-2018:1267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1267"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DPDK",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "before 18.02.1"
            }
          ]
        }
      ],
      "datePublic": "2018-04-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-21T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2018:2524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2524"
        },
        {
          "name": "RHSA-2018:2102",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2102"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2018-1059"
        },
        {
          "name": "USN-3642-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3642-2/"
        },
        {
          "name": "RHSA-2018:2038",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2038"
        },
        {
          "name": "USN-3642-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3642-1/"
        },
        {
          "name": "RHSA-2018:1267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1267"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-04-23T00:00:00",
          "ID": "CVE-2018-1059",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DPDK",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 18.02.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Red Hat, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:2524",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2524"
            },
            {
              "name": "RHSA-2018:2102",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2102"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2018-1059",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2018-1059"
            },
            {
              "name": "USN-3642-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3642-2/"
            },
            {
              "name": "RHSA-2018:2038",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2038"
            },
            {
              "name": "USN-3642-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3642-1/"
            },
            {
              "name": "RHSA-2018:1267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1267"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1059",
    "datePublished": "2018-04-24T18:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:46:47.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2132 (GCVE-0-2022-2132)

Vulnerability from cvelistv5 – Published: 2022-08-31 15:32 – Updated: 2024-08-03 00:24
VLAI?
Summary
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
Severity ?
No CVSS data available.
CWE
  • CWE-791 - >CWE-183->CWE-641->CWE-770
Assigner
Impacted products
Vendor Product Version
n/a dpdk Affected: dpdk 21.11, dpdk 20.11, dpdk 19.11
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.195Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
          },
          {
            "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "dpdk 21.11, dpdk 20.11, dpdk 19.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-791",
              "description": "CWE-791-\u003eCWE-183-\u003eCWE-641-\u003eCWE-770",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-02T06:06:28.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
        },
        {
          "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2022-2132",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "dpdk",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "dpdk 21.11, dpdk 20.11, dpdk 19.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-791-\u003eCWE-183-\u003eCWE-641-\u003eCWE-770"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2099475"
            },
            {
              "name": "https://bugs.dpdk.org/show_bug.cgi?id=1031",
              "refsource": "MISC",
              "url": "https://bugs.dpdk.org/show_bug.cgi?id=1031"
            },
            {
              "name": "[debian-lts-announce] 20220902 [SECURITY] [DLA 3092-1] dpdk security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00000.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-2132",
    "datePublished": "2022-08-31T15:32:58.000Z",
    "dateReserved": "2022-06-20T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:24:44.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3839 (GCVE-0-2021-3839)

Vulnerability from cvelistv5 – Published: 2022-08-23 15:52 – Updated: 2024-08-03 17:09
VLAI?
Summary
A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Severity ?
No CVSS data available.
CWE
  • CWE-125 - - Out-of-bounds Read | CWE-787 - Out-of-bounds Write
Assigner
Impacted products
Vendor Product Version
n/a dpdk Affected: Fixed in dpdk v22.03
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in dpdk v22.03"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg-\u003epayload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 - Out-of-bounds Read | CWE-787 - Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-23T15:52:42.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3839",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "dpdk",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Fixed in dpdk v22.03"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg-\u003epayload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125 - Out-of-bounds Read | CWE-787 - Out-of-bounds Write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2025882"
            },
            {
              "name": "https://access.redhat.com/security/cve/CVE-2021-3839",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/CVE-2021-3839"
            },
            {
              "name": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5",
              "refsource": "MISC",
              "url": "https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3839",
    "datePublished": "2022-08-23T15:52:42.000Z",
    "dateReserved": "2021-09-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3905 (GCVE-0-2021-3905)

Vulnerability from cvelistv5 – Published: 2022-08-23 00:00 – Updated: 2024-08-03 17:09
VLAI?
Summary
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
Severity ?
No CVSS data available.
CWE
  • CWE-401 - - Missing Release of Memory after Effective Lifetime
Assigner
Impacted products
Vendor Product Version
n/a openvswitch (ovs) Affected: Fixed in v2.17.0
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019692"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-3905"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2021-3905"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openvswitch/ovs-issues/issues/226"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349"
          },
          {
            "name": "GLSA-202311-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-16"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openvswitch (ovs)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in v2.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 - Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-26T11:06:13.552Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019692"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-3905"
        },
        {
          "url": "https://ubuntu.com/security/CVE-2021-3905"
        },
        {
          "url": "https://github.com/openvswitch/ovs-issues/issues/226"
        },
        {
          "url": "https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349"
        },
        {
          "name": "GLSA-202311-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202311-16"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3905",
    "datePublished": "2022-08-23T00:00:00.000Z",
    "dateReserved": "2021-10-26T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14818 (GCVE-0-2019-14818)

Vulnerability from cvelistv5 – Published: 2019-11-14 00:00 – Updated: 2024-08-05 00:26
VLAI?
Summary
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
CWE
Assigner
Impacted products
Vendor Product Version
DPDK dpdk Affected: all dpdk version 17.x.x before 17.11.8
Affected: all dpdk version 16.x.x before 16.11.10
Affected: all dpdk version 18.x.x before 18.11.4
Affected: all dpdk version 19.x.x before 19.08.1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:26:39.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2019-019df9a459",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/"
          },
          {
            "name": "RHSA-2020:0166",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0166"
          },
          {
            "name": "RHSA-2020:0165",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0165"
          },
          {
            "name": "RHSA-2020:0168",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0168"
          },
          {
            "name": "RHSA-2020:0172",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0172"
          },
          {
            "name": "RHSA-2020:0171",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0171"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.dpdk.org/show_bug.cgi?id=363"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dpdk",
          "vendor": "DPDK",
          "versions": [
            {
              "status": "affected",
              "version": "all dpdk version 17.x.x before 17.11.8"
            },
            {
              "status": "affected",
              "version": "all dpdk version 16.x.x before 16.11.10"
            },
            {
              "status": "affected",
              "version": "all dpdk version 18.x.x before 18.11.4"
            },
            {
              "status": "affected",
              "version": "all dpdk version 19.x.x before 19.08.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2019-019df9a459",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/"
        },
        {
          "name": "RHSA-2020:0166",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0166"
        },
        {
          "name": "RHSA-2020:0165",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0165"
        },
        {
          "name": "RHSA-2020:0168",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0168"
        },
        {
          "name": "RHSA-2020:0172",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0172"
        },
        {
          "name": "RHSA-2020:0171",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0171"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818"
        },
        {
          "url": "https://bugs.dpdk.org/show_bug.cgi?id=363"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-14818",
    "datePublished": "2019-11-14T00:00:00.000Z",
    "dateReserved": "2019-08-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:26:39.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1059 (GCVE-0-2018-1059)

Vulnerability from cvelistv5 – Published: 2018-04-24 18:00 – Updated: 2024-09-17 00:46
VLAI?
Summary
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Severity ?
No CVSS data available.
CWE
Assigner
References
https://access.redhat.com/errata/RHSA-2018:2524 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2102 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/cve-2018-1059 x_refsource_MISC
https://usn.ubuntu.com/3642-2/ vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:2038 vendor-advisoryx_refsource_REDHAT
https://usn.ubuntu.com/3642-1/ vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:1267 vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1544298 x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat, Inc. DPDK Affected: before 18.02.1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:44:11.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:2524",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2524"
          },
          {
            "name": "RHSA-2018:2102",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2102"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2018-1059"
          },
          {
            "name": "USN-3642-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3642-2/"
          },
          {
            "name": "RHSA-2018:2038",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2038"
          },
          {
            "name": "USN-3642-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3642-1/"
          },
          {
            "name": "RHSA-2018:1267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1267"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DPDK",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "before 18.02.1"
            }
          ]
        }
      ],
      "datePublic": "2018-04-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-21T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2018:2524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2524"
        },
        {
          "name": "RHSA-2018:2102",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2102"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2018-1059"
        },
        {
          "name": "USN-3642-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3642-2/"
        },
        {
          "name": "RHSA-2018:2038",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2038"
        },
        {
          "name": "USN-3642-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3642-1/"
        },
        {
          "name": "RHSA-2018:1267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1267"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-04-23T00:00:00",
          "ID": "CVE-2018-1059",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DPDK",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 18.02.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Red Hat, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:2524",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2524"
            },
            {
              "name": "RHSA-2018:2102",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2102"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2018-1059",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2018-1059"
            },
            {
              "name": "USN-3642-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3642-2/"
            },
            {
              "name": "RHSA-2018:2038",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2038"
            },
            {
              "name": "USN-3642-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3642-1/"
            },
            {
              "name": "RHSA-2018:1267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1267"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1544298"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1059",
    "datePublished": "2018-04-24T18:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:46:47.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}