[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 29 Aug 2022 20:12:18 +0200
From: Thomas Monjalon <thomas@...jalon.net>
To: announce@...k.org
Cc: security@...k.org, oss-security@...ts.openwall.com
Subject: CVE-2022-2132: DPDK copy_desc_to_mbuf() Vhost header vulnerability
A vulnerability was fixed in DPDK.
Some downstream stakeholders were warned in advance
in order to coordinate the release of fixes
and reduce the vulnerability window.
In copy_desc_to_mbuf() function,
the Vhost header was assumed not across more than two descriptors.
If a malicious guest send a packet
with the Vhost header crossing more than two descriptors,
the buf_avail will be a very large number near 4G.
All the mbufs will be allocated,
therefore other guests traffic will be blocked.
A malicious guest can cause denial of service
for the other guest running on the hypervisor.
CVE: CVE-2022-2132
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=1031
Severity: 8.6 (High)
CVSS scores: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Commits per branch:
main
https://git.dpdk.org/dpdk/commit/?id=71bd0cc536
https://git.dpdk.org/dpdk/commit/?id=dc1516e260
21.11
https://git.dpdk.org/dpdk-stable/commit/?id=f167022606
https://git.dpdk.org/dpdk-stable/commit/?id=e12d415556
20.11
https://git.dpdk.org/dpdk-stable/commit/?id=8fff8520f3
https://git.dpdk.org/dpdk-stable/commit/?id=089e01b375
19.11
https://git.dpdk.org/dpdk-stable/commit/?id=5b3c25e6ee
https://git.dpdk.org/dpdk-stable/commit/?id=e73049ea26
LTS Releases:
21.11 - http://fast.dpdk.org/rel/dpdk-21.11.2.tar.xz
20.11 - http://fast.dpdk.org/rel/dpdk-20.11.6.tar.xz
19.11 - http://fast.dpdk.org/rel/dpdk-19.11.13.tar.xz
CVE: CVE-2022-2132
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=1031
Severity: 8.6 (High)
CVSS scores: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
