Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2022-2132

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

CVSS 3.1 · 8.6 High EPSS 2.4% KEV · Not listed
Vendors
Debian Dpdk Fedoraproject and 1 more
Products
Debian Linux Data Plane Development Kit Fedora and 12 more
CVE-2021-3905

openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Fedoraproject Openvswitch and 1 more
Products
Ubuntu Linux Fedora Openvswitch and 2 more
CVE-2021-3839

DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Dpdk Fedoraproject Redhat
Products
Data Plane Development Kit Fedora Enterprise Linux and 1 more
CVE-2019-14818

dpdk: possible memory leak leads to denial of service

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Dpdk Fedoraproject Redhat
Products
Data Plane Development Kit Fedora Enterprise Linux and 4 more
CVE-2018-1059

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Dpdk Redhat
Products
Ubuntu Linux Data Plane Development Kit Ceph Storage and 8 more