CVE Feed

    Dashboard / CVE / CVE-2021-3839

    CVE-2021-3839

    A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

    Published:Apr 29, 2022
    Last Modified:Nov 21, 2024
    EPS:Aug 23, 2022
    EPSS Score:0.00126
    CVSS Score:7.5

    Affected Products

    Vendor
    Dpdk
    Product
    Data Plane Development Kit
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Fast Datapath

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2022-2132 (CVSS 8.6) — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a den…
    CVE-2022-0669 (CVSS 6.5) — A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds…
    CVE-2020-14375 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data…
    CVE-2020-14374 (CVSS 8.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_…
    CVE-2020-14376 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copyin…
    CVE-2020-14377 (CVSS 7.1) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of atta…
    CVE-2020-14378 (CVSS 3.3) — An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead …
    CVE-2020-10723 (CVSS 5.1) — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer trunca…
    CVE-2020-10724 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validatio…
    CVE-2020-10722 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High