CVE Feed

    Dashboard / CVE / CVE-2020-10725

    CVE-2020-10725

    A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

    Published:May 18, 2020
    Last Modified:Nov 21, 2024
    EPS:May 20, 2020
    EPSS Score:0.00683
    CVSS Score:7.7

    Affected Products

    Vendor
    Dpdk
    Product
    Data Plane Development Kit
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Enterprise Communications Broker
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Eus

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-665 Improper Initialization

    Related CVEs

    CVE-2022-2132 (CVSS 8.6) — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a den…
    CVE-2021-3839 (CVSS 7.5) — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->p…
    CVE-2022-0669 (CVSS 6.5) — A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds…
    CVE-2020-14375 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data…
    CVE-2020-14374 (CVSS 8.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_…
    CVE-2020-14376 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copyin…
    CVE-2020-14377 (CVSS 7.1) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of atta…
    CVE-2020-14378 (CVSS 3.3) — An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead …
    CVE-2020-10723 (CVSS 5.1) — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer trunca…
    CVE-2020-10724 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validatio…

    References

    http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html
    https://bugs.dpdk.org/show_bug.cgi?id=270
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
    https://www.openwall.com/lists/oss-security/2020/05/18/2
    https://www.oracle.com/security-alerts/cpujan2021.html
    http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html
    https://bugs.dpdk.org/show_bug.cgi?id=270
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
    https://www.openwall.com/lists/oss-security/2020/05/18/2
    https://www.oracle.com/security-alerts/cpujan2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High