CVE Feed

    Dashboard / CVE / CVE-2022-0669

    CVE-2022-0669

    A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

    Published:Apr 29, 2022
    Last Modified:Nov 21, 2024
    EPS:Aug 29, 2022
    EPSS Score:0.00129
    CVSS Score:6.5

    Affected Products

    Vendor
    Dpdk
    Product
    Data Plane Development Kit
    Vendor
    Openvswitch
    Product
    Openvswitch
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Openshift Container Platform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-2132 (CVSS 8.6) — A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a den…
    CVE-2021-3839 (CVSS 7.5) — A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->p…
    CVE-2020-14375 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data…
    CVE-2020-14374 (CVSS 8.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_…
    CVE-2020-14376 (CVSS 7.8) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copyin…
    CVE-2020-14377 (CVSS 7.1) — A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of atta…
    CVE-2020-14378 (CVSS 3.3) — An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead …
    CVE-2020-10723 (CVSS 5.1) — A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer trunca…
    CVE-2020-10724 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validatio…
    CVE-2020-10722 (CVSS 5.1) — A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High