CVE-2021-3839

    Dashboard / Vulnerabilities / CVE-2021-3839

    CVE-2021-3839

    Published: 23 Aug 2022Last Modified: 9 Jul 2026

    Summary:

    Details: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

    References: https://access.redhat.com/security/cve/CVE-2021-3839, https://bugzilla.redhat.com/show_bug.cgi?id=2025882, https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -80c5b4d6355d1dbece8dd1f812d374f3e24086bc

    Affected versions

    22.03-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-3839 | CVE-DB