Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 21.11-4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- dpdk
From 21.05 · fixed in 21.11-4
- openvswitch3.1
Version range not reported
- openvswitch3.1
Version range not reported
- openvswitch3.3
Version range not reported
- openvswitch3.4
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- dpdk
Version range not reported
- openvswitch
Version range not reported
- openvswitch2.10
Version range not reported
- openvswitch2.11
Version range not reported
- openvswitch2.12
Version range not reported
- openvswitch2.11
Version range not reported
- openvswitch2.12
Version range not reported
- openvswitch2.13
Version range not reported
- openvswitch2.15
Version range not reported
- openvswitch2.16
Version range not reported
- openvswitch2.17
Version range not reported
- openvswitch2.17
Version range not reported
- openvswitch3.0
Version range not reported
- openvswitch3.2
Version range not reported
- openvswitch2.17
Version range not reported
- openvswitch3.0
Version range not reported
- openvswitch3.1
Version range not reported
- openvswitch3.3
Version range not reported