A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1735 advisory.

  - A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4     and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can     send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This     flaw could lead to a denial of service condition. (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1735 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1735 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for dpdk to version 16.11.9 following issue :

CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicious container may lead to to denial of service (bsc#1156146).

CVE-2020-12693: Fixed an authentication bypass via an alternate path or channel (boo#1172004).

rebuilt with new signing key. (bsc#1174543)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the spdk package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in all dpdk version 17.x.x before     17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4     and 19.x.x before 19.08.1 where a malicious master, or     a container with access to vhost_user socket, can send     specially crafted VRING_SET_NUM messages, resulting in     a memory leak including file descriptors. This flaw     could lead to a denial of service     condition.(CVE-2019-14818)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dpdk to 17.11.7 fixes the following issues :

Security issues fixed :

CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477 bsc#1171930).

CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the spdk package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in all dpdk version 17.x.x before     17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4     and 19.x.x before 19.08.1 where a malicious master, or     a container with access to vhost_user socket, can send     specially crafted VRING_SET_NUM messages, resulting in     a memory leak including file descriptors. This flaw     could lead to a denial of service     condition.(CVE-2019-14818)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1226 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for dpdk to version 18.11.3 fixes the following issues :

Security issue fixed :

CVE-2019-14818: Fixed a denial of service by a malicious container via the vhost-user socket (bsc#1156146).

Non-security issue fixed: Added current version to the PMD driver directory to avoid loading previous version drivers (bsc#1157179).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dpdk to version 18.11.3 fixes the following issues :

dpdk was updated to 18.11.3

Security issue fixed :

CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicious container may lead to to denial of service (bsc#1156146).

Other issues addressed: Changed to multibuild (bsc#1151455).

Fixed a regression caused by loading old version drivers (bsc#1157179).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0172 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0171 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0168 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0166 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0165 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the dpdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in all dpdk version 17.x.x before     17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4     and 19.x.x before 19.08.1 where a malicious master, or     a container with access to vhost_user socket, can send     specially crafted VRING_SET_NUM messages, resulting in     a memory leak including file descriptors. This flaw     could lead to a denial of service     condition.(CVE-2019-14818)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of dpdk to version 18.11.3 provides the following fixes :

dpdk was updated to 18.11.3 (fate#327817, bsc#1145713, jsc#ECO-274, fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jsc#SLE-4715)

Security issue fixed :

CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicius container may lead to to denial of service (bsc#1156146).

Other issues addressed: Fixed a regression by inserting version numbers to the drivers (bsc#1157179).

Changed to multibuild (bsc#1151455).

Added support for using externally allocated memory in DPDK.

Added check for ensuring allocated memory is addressable by devices.

Updated the C11 memory model version of the ring library.

Added NXP CAAM JR PMD.

Added support for GEN3 devices to Intel QAT driver.

Added Distributed Software Eventdev PMD.

Updated KNI kernel module, rte_kni library, and KNI sample application.

Add a new sample application for vDPA.

Updated mlx5 driver.

  - Improved security of PMD to prevent the NIC from getting     stuck when the application misbehaves.

  - Reworked flow engine to supported e-switch flow rules     (transfer attribute).

  - Added support for header re-write(L2-L4), VXLAN     encap/decap, count, match on TCP flags and multiple flow     groups with e-switch flow rules.

  - Added support for match on metadata, VXLAN and MPLS     encap/decap with flow rules.

  - Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to     provide better support for representors.

  - Added support for meson build.

  - Fixed build issue with PPC.

  - Added support for BlueField VF.

  - Added support for externally allocated static memory for     DMA.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dpdk to version 17.11.7 fixes the following issues :

CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicious container may lead to to denial of service (bsc#1156146).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for [PUT CVEs HERE]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jason Wang discovered that DPDK incorrectly handled certain messages.
An attacker in a malicious container could possibly use this issue to cause DPDK to leak resources, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the vhost PMD in DPDK, a set of libraries for fast packet processing, was affected by memory and file descriptor leaks which could result in denial of service.

ID	Name	Product	Family	Severity
180989	Oracle Linux 8 : dpdk (ELSA-2020-1735)	Nessus	Oracle Linux Local Security Checks	high
145808	CentOS 8 : dpdk (CESA-2020:1735)	Nessus	CentOS Local Security Checks	high
143011	RHEL 8 : dpdk (RHSA-2020:1735)	Nessus	Red Hat Local Security Checks	high
139532	SUSE SLES12 Security Update : dpdk (SUSE-SU-2020:2194-1)	Nessus	SuSE Local Security Checks	high
138012	EulerOS Virtualization 3.0.6.0 : spdk (EulerOS-SA-2020-1793)	Nessus	Huawei Local Security Checks	high
137544	SUSE SLES12 Security Update : dpdk (SUSE-SU-2020:1430-1)	Nessus	SuSE Local Security Checks	medium
136278	EulerOS Virtualization for ARM 64 3.0.2.0 : spdk (EulerOS-SA-2020-1575)	Nessus	Huawei Local Security Checks	high
135083	RHEL 7 : dpdk (RHSA-2020:1226)	Nessus	Red Hat Local Security Checks	high
134035	SUSE SLED15 / SLES15 Security Update : dpdk (SUSE-SU-2020:0439-1)	Nessus	SuSE Local Security Checks	high
133836	SUSE SLES12 Security Update : dpdk (SUSE-SU-2020:0412-1)	Nessus	SuSE Local Security Checks	high
133161	RHEL 8 : openvswitch2.12 (RHSA-2020:0172)	Nessus	Red Hat Local Security Checks	high
133160	RHEL 8 : openvswitch2.11 (RHSA-2020:0171)	Nessus	Red Hat Local Security Checks	high
133159	RHEL 7 : openvswitch2.12 (RHSA-2020:0168)	Nessus	Red Hat Local Security Checks	high
133127	RHEL 7 : openvswitch2.11 (RHSA-2020:0166)	Nessus	Red Hat Local Security Checks	high
133126	RHEL 7 : openvswitch (RHSA-2020:0165)	Nessus	Red Hat Local Security Checks	high
132846	EulerOS Virtualization for ARM 64 3.0.5.0 : spdk (EulerOS-SA-2020-1092)	Nessus	Huawei Local Security Checks	high
132632	EulerOS 2.0 SP8 : dpdk (EulerOS-SA-2020-1039)	Nessus	Huawei Local Security Checks	high
132355	EulerOS 2.0 SP5 : dpdk (EulerOS-SA-2019-2688)	Nessus	Huawei Local Security Checks	high
131752	SUSE SLES15 Security Update : dpdk (SUSE-SU-2019:3179-1)	Nessus	SuSE Local Security Checks	high
131222	SUSE SLES12 Security Update : dpdk (SUSE-SU-2019:3032-1)	Nessus	SuSE Local Security Checks	high
131195	Fedora 31 : 2:dpdk (2019-019df9a459)	Nessus	Fedora Local Security Checks	high
131015	Ubuntu 18.04 LTS : DPDK vulnerability (USN-4189-1)	Nessus	Ubuntu Local Security Checks	high
130985	Debian DSA-4567-1 : dpdk - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-14818

high

Tenable Plugins

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high