Data Plane Development Kit Dpdk Data Plane Development Kit

Do you want an email whenever new security vulnerabilities are reported in Dpdk Data Plane Development Kit?

By the Year

In 2022 there have been 0 vulnerabilities in Dpdk Data Plane Development Kit . Data Plane Development Kit did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 0 0.00
2020 10 6.47
2019 1 7.50
2018 1 6.10

It may take a day or so for new Data Plane Development Kit vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Dpdk Data Plane Development Kit Security Vulnerabilities

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5

CVE-2020-14374 8.8 - High - September 30, 2020

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Classic Buffer Overflow

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5

CVE-2020-14375 7.8 - High - September 30, 2020

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

TOCTTOU

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5

CVE-2020-14376 7.8 - High - September 30, 2020

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Classic Buffer Overflow

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5

CVE-2020-14377 7.1 - High - September 30, 2020

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.

Out-of-bounds Read

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function

CVE-2020-14378 3.3 - Low - September 30, 2020

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

Integer underflow

A flaw was found in DPDK version 19.11 and above

CVE-2020-10725 7.7 - High - May 20, 2020

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Improper Initialization

A vulnerability was found in DPDK versions 19.11 and above

CVE-2020-10726 4.4 - Medium - May 20, 2020

A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.

Integer Overflow or Wraparound

A vulnerability was found in DPDK versions 18.05 and above

CVE-2020-10722 6.7 - Medium - May 19, 2020

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

Integer Overflow or Wraparound

A memory corruption issue was found in DPDK versions 17.05 and above

CVE-2020-10723 6.7 - Medium - May 19, 2020

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.

Integer Overflow or Wraparound

A vulnerability was found in DPDK versions 18.11 and above

CVE-2020-10724 4.4 - Medium - May 19, 2020

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Out-of-bounds Read

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket

CVE-2019-14818 7.5 - High - November 14, 2019

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

Memory Leak

The DPDK vhost-user interface does not check to verify

CVE-2018-1059 6.1 - Medium - April 24, 2018

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Information Disclosure

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux (RHEL) or by Dpdk? Click the Watch button to subscribe.

Dpdk
Vendor

subscribe