CVE Feed

    Dashboard / CVE / CVE-2019-14818

    CVE-2019-14818

    A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

    Published:Nov 12, 2019
    Last Modified:Nov 21, 2024
    EPS:Nov 14, 2019
    EPSS Score:0.01137
    CVSS Score:7.5

    Affected Products

    Vendor
    Dpdk
    Product
    Data Plane Development Kit
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Fast Datapath
    Vendor
    Redhat
    Product
    Openstack
    Vendor
    Redhat
    Product
    Rhel Extras Other
    Vendor
    Redhat
    Product
    Virtualization Eus

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2022-2132 (CVSS 8.6) — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a den…
    CVE-2021-3839 (CVSS 7.5) — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->p…
    CVE-2022-0669 (CVSS 6.5) — A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds…
    CVE-2020-14375 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data…
    CVE-2020-14374 (CVSS 8.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_…
    CVE-2020-14376 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copyin…
    CVE-2020-14377 (CVSS 7.1) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of atta…
    CVE-2020-14378 (CVSS 3.3) — An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead …
    CVE-2020-10723 (CVSS 5.1) — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer trunca…
    CVE-2020-10724 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validatio…

    References

    https://access.redhat.com/errata/RHSA-2020:0165
    https://access.redhat.com/errata/RHSA-2020:0166
    https://access.redhat.com/errata/RHSA-2020:0168
    https://access.redhat.com/errata/RHSA-2020:0171
    https://access.redhat.com/errata/RHSA-2020:0172
    https://bugs.dpdk.org/show_bug.cgi?id=363
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/
    https://access.redhat.com/errata/RHSA-2020:0165
    https://access.redhat.com/errata/RHSA-2020:0166
    https://access.redhat.com/errata/RHSA-2020:0168
    https://access.redhat.com/errata/RHSA-2020:0171
    https://access.redhat.com/errata/RHSA-2020:0172
    https://bugs.dpdk.org/show_bug.cgi?id=363
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High