A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dpdk-develUpgrade dpdkUpgrade dpdk-toolsUpgrade dpdk-doc | Nov 21, 2022 | Aug 23, 2022 |
| Centos_linux | — | Upgrade openvswitch2.16-debugsourceUpgrade network-scripts-openvswitch2.15Upgrade python3-openvswitch2.13Upgrade network-scripts-openvswitch2.16Upgrade openvswitch2.15-develUpgrade openvswitch2.16-debuginfoUpgrade openvswitch2.16Upgrade openvswitch2.15-ipsecUpgrade python3-openvswitch2.16-debuginfoUpgrade dpdkUpgrade openvswitch2.13-develUpgrade openvswitch2.13-testUpgrade openvswitch2.16-ipsecUpgrade openvswitch2.15Upgrade openvswitch2.15-debuginfoUpgrade openvswitch2.15-debugsourceUpgrade openvswitch2.13Upgrade python3-openvswitch2.13-debuginfoUpgrade openvswitch2.16-develUpgrade dpdk-toolsUpgrade dpdk-debugsourceUpgrade dpdk-debuginfoUpgrade python3-openvswitch2.15-debuginfoUpgrade python3-openvswitch2.15Upgrade openvswitch2.15-testUpgrade openvswitch2.13-ipsecUpgrade dpdk-docUpgrade python3-openvswitch2.16Upgrade network-scripts-openvswitch2.13Upgrade dpdk-develUpgrade openvswitch2.13-debuginfoUpgrade openvswitch2.13-debugsourceUpgrade openvswitch2.16-test | May 30, 2022 | May 27, 2022 |
| Debian | — | Upgrade dpdk | Nov 4, 2022 | Aug 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade dpdk-toolsUpgrade dpdk | Aug 18, 2022 | Aug 17, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade dpdkUpgrade dpdk-tools | Sep 14, 2022 | Aug 23, 2022 |
| Oracle_linux | — | Upgrade dpdkUpgrade dpdk-develUpgrade dpdk-docUpgrade dpdk-tools | Nov 22, 2022 | Apr 29, 2022 |
| Redhat_linux | — | Upgrade dpdk-debuginfoUpgrade dpdk-toolsUpgrade dpdk-develUpgrade dpdk-docUpgrade dpdk-debugsourceUpgrade dpdkNo solution exists | May 30, 2022 | May 27, 2022 |
| Rocky_linux | — | Upgrade dpdkUpgrade dpdk-develUpgrade dpdk-debugsourceUpgrade dpdk-debuginfoUpgrade dpdk-tools | Mar 12, 2024 | Aug 23, 2022 |
| Suse | — | Upgrade libdpdk-20_0Upgrade dpdk-examplesUpgrade dpdk-thunderx-examplesUpgrade dpdk-kmp-preemptUpgrade dpdk-docUpgrade dpdk-thunderxUpgrade dpdk-thunderx-toolsUpgrade dpdk-toolsUpgrade dpdk-kmp-defaultUpgrade dpdk-thunderx-kmp-preemptUpgrade dpdkUpgrade dpdk-thunderx-docUpgrade dpdk-develUpgrade dpdk-thunderx-kmp-defaultUpgrade dpdk-thunderx-devel | Oct 26, 2022 | Aug 23, 2022 |
| Ubuntu | — | Upgrade dpdk | May 5, 2022 | May 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub