dpdk data-plane-development-kit CVE-2020-10725 vulnerability in Dpdk and Other Products
Published on May 20, 2020

product logo product logo product logo product logo
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-10725 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

Improper Initialization

The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.


Products Associated with CVE-2020-10725

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-10725 are published in these products:

Dpdk Data Plane Development Kit
 
Fedora Project Fedora
 
OpenSuse Leap
 
Oracle Enterprise Communications Broker
 

Affected Versions

[UNKNOWN] dpdk:

Exploit Probability

EPSS
0.61%
Percentile
69.39%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.