CVE Feed

    Dashboard / CVE / CVE-2020-10726

    CVE-2020-10726

    A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.

    Published:May 18, 2020
    Last Modified:Nov 21, 2024
    EPS:May 20, 2020
    EPSS Score:0.00152
    CVSS Score:6

    Affected Products

    Vendor
    Dpdk
    Product
    Data Plane Development Kit
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Enterprise Communications Broker
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-2132 (CVSS 8.6) — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a den…
    CVE-2021-3839 (CVSS 7.5) — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->p…
    CVE-2022-0669 (CVSS 6.5) — A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds…
    CVE-2020-14375 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data…
    CVE-2020-14374 (CVSS 8.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_…
    CVE-2020-14376 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copyin…
    CVE-2020-14377 (CVSS 7.1) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of atta…
    CVE-2020-14378 (CVSS 3.3) — An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead …
    CVE-2020-10723 (CVSS 5.1) — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer trunca…
    CVE-2020-10724 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validatio…

    References

    http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html
    https://bugs.dpdk.org/show_bug.cgi?id=271
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10726
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
    https://www.openwall.com/lists/oss-security/2020/05/18/2
    https://www.oracle.com/security-alerts/cpujan2021.html
    http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html
    https://bugs.dpdk.org/show_bug.cgi?id=271
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10726
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
    https://www.openwall.com/lists/oss-security/2020/05/18/2
    https://www.oracle.com/security-alerts/cpujan2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High