A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1239 advisory.

  - dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has dpdk packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation     fault of the vhost-user backend application running on the host, which could result in a loss of     connectivity for the other guests running on that host. This is caused by a missing validity check of the     descriptor address in the function `virtio_dev_rx_batch_packed()`. (CVE-2020-10725)

  - A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access     to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak     (file descriptors and virtual memory), which may result in a denial of service. (CVE-2020-10726)

  - A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in     vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory     corruption. (CVE-2020-10722)

  - A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer     truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and     truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.
    (CVE-2020-10723)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4806 advisory.

  - dpdk: librte_vhost Integer overflow in vhost_user_set_log_base() (CVE-2020-10722)

  - dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

  - dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

  - dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4806 advisory.

  - A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in     vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory     corruption. (CVE-2020-10722)

  - A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation     fault of the vhost-user backend application running on the host, which could result in a loss of     connectivity for the other guests running on that host. This is caused by a missing validity check of the     descriptor address in the function `virtio_dev_rx_batch_packed()`. (CVE-2020-10725)

  - A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer     truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and     truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.
    (CVE-2020-10723)

  - A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access     to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak     (file descriptors and virtual memory), which may result in a denial of service. (CVE-2020-10726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4806 advisory.

  - dpdk: librte_vhost Integer overflow in vhost_user_set_log_base() (CVE-2020-10722)

  - dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

  - dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

  - dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix cvws CVE-2020-10726,CVE-2020-10724,CVE-2020-10723,CVE-2020-10722,CVE-2020-1 0725

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2295 advisory.

  - dpdk: librte_vhost Integer overflow in vhost_user_set_log_base() (CVE-2020-10722)

  - dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

  - dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

  - dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

  - dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for dpdk fixes the following issues :

Security issues fixed :

  - CVE-2020-10722: Fixed an integer overflow in     vhost_user_set_log_base() (bsc#1171477).

  - CVE-2020-10723: Fixed an integer truncation in     vhost_user_check_and_alloc_queue_pair() (bsc#1171477).

  - CVE-2020-10724: Fixed a missing inputs validation in     Vhost-crypto (bsc#1171477).

  - CVE-2020-10725: Fixed a segfault caused by invalid     virtio descriptors sent from a malicious guest     (bsc#1171477).

  - CVE-2020-10726: Fixed a denial-of-service caused by     VHOST_USER_GET_INFLIGHT_FD message flooding     (bsc#1171477).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dpdk fixes the following issues :

Security issues fixed :

CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477).

CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).

CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477).

CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477).

CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that DPDK incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2020-10722, CVE-2020-10723, CVE-2020-10724, CVE-2020-10725, CVE-2020-10726).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148769	RHEL 8 : dpdk (RHSA-2021:1239)	Nessus	Red Hat Local Security Checks	high
147295	NewStart CGSL MAIN 6.02 : dpdk Multiple Vulnerabilities (NS-SA-2021-0073)	Nessus	NewStart CGSL Local Security Checks	medium
145980	CentOS 8 : dpdk (CESA-2020:4806)	Nessus	CentOS Local Security Checks	medium
142795	Oracle Linux 8 : dpdk (ELSA-2020-4806)	Nessus	Oracle Linux Local Security Checks	medium
142390	RHEL 8 : dpdk (RHSA-2020:4806)	Nessus	Red Hat Local Security Checks	medium
137103	Fedora 32 : 2:dpdk (2020-04e3d34451)	Nessus	Fedora Local Security Checks	medium
136899	RHEL 8 : openvswitch2.13 (RHSA-2020:2295)	Nessus	Red Hat Local Security Checks	medium
136882	openSUSE Security Update : dpdk (openSUSE-2020-693)	Nessus	SuSE Local Security Checks	medium
136795	SUSE SLED15 / SLES15 Security Update : dpdk (SUSE-SU-2020:1335-1)	Nessus	SuSE Local Security Checks	medium
136709	Ubuntu 18.04 LTS / 20.04 LTS : DPDK vulnerabilities (USN-4362-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-10725

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium