A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dpdk-docUpgrade dpdk-toolsUpgrade dpdk-develUpgrade dpdk | Nov 21, 2022 | Aug 23, 2022 |
| Centos_linux | — | Upgrade openvswitch2.16-ipsecUpgrade openvswitch2.13-testUpgrade network-scripts-openvswitch2.16Upgrade openvswitch2.15-ipsecUpgrade openvswitch2.13-develUpgrade python3-openvswitch2.16-debuginfoUpgrade dpdkUpgrade python3-openvswitch2.13Upgrade openvswitch2.16-debugsourceUpgrade network-scripts-openvswitch2.15Upgrade openvswitch2.15-debuginfoUpgrade openvswitch2.15-debugsourceUpgrade openvswitch2.15-develUpgrade openvswitch2.16-debuginfoUpgrade openvswitch2.16Upgrade openvswitch2.15Upgrade openvswitch2.13-debugsourceUpgrade openvswitch2.13-debuginfoUpgrade openvswitch2.16-testUpgrade openvswitch2.13Upgrade openvswitch2.13-ipsecUpgrade dpdk-docUpgrade python3-openvswitch2.16Upgrade python3-openvswitch2.15-debuginfoUpgrade dpdk-develUpgrade dpdk-debugsourceUpgrade dpdk-debuginfoUpgrade openvswitch2.16-develUpgrade python3-openvswitch2.13-debuginfoUpgrade network-scripts-openvswitch2.13Upgrade dpdk-toolsUpgrade python3-openvswitch2.15Upgrade openvswitch2.15-test | May 30, 2022 | May 27, 2022 |
| Debian | — | Upgrade dpdk | Nov 4, 2022 | Aug 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade dpdk-toolsUpgrade dpdk | Aug 18, 2022 | Aug 17, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade dpdkUpgrade dpdk-tools | Sep 14, 2022 | Aug 23, 2022 |
| Oracle_linux | — | Upgrade dpdk-develUpgrade dpdk-toolsUpgrade dpdk-docUpgrade dpdk | Nov 22, 2022 | Apr 29, 2022 |
| Redhat_linux | — | Upgrade dpdk-docUpgrade dpdk-toolsUpgrade dpdk-debuginfoUpgrade dpdk-develUpgrade dpdkNo solution existsUpgrade dpdk-debugsource | May 30, 2022 | May 27, 2022 |
| Rocky_linux | — | Upgrade dpdk-debuginfoUpgrade dpdk-debugsourceUpgrade dpdk-toolsUpgrade dpdk-develUpgrade dpdk | Mar 12, 2024 | Aug 23, 2022 |
| Suse | — | Upgrade dpdk-thunderx-toolsUpgrade dpdk-examplesUpgrade dpdk-kmp-preemptUpgrade libdpdk-20_0Upgrade dpdk-thunderxUpgrade dpdk-thunderx-examplesUpgrade dpdk-docUpgrade dpdk-toolsUpgrade dpdk-develUpgrade dpdk-thunderx-develUpgrade dpdk-thunderx-docUpgrade dpdkUpgrade dpdk-thunderx-kmp-defaultUpgrade dpdk-thunderx-kmp-preemptUpgrade dpdk-kmp-default | Oct 26, 2022 | Aug 23, 2022 |
| Ubuntu | — | Upgrade dpdk | May 5, 2022 | May 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub