The remote Ubuntu 20.04 LTS / 21.10 / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5401-1 advisory.

  - A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate     `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using     DPDK vhost library may crash as a result of this vulnerability. (CVE-2021-3839)

  - A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of     fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not     closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts     available fd in the vhost-user slave process, leading to a denial of service. (CVE-2022-0669)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 20.04 LTS / 22.04 LTS : DPDK vulnerabilities (USN-5401-1)

high Nessus Plugin ID 160506

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.7 Oct 21, 2023, 5:06 AM Detection Exploit attributes ("Exploit available" set to "False") Plugin metadata Plugin Feed: 202310210506
Version 1.6 Jul 11, 2023, 4:01 AM Detection Plugin Feed: 202307110401
Version 1.5 Mar 21, 2023, 7:30 PM Plugin metadata Plugin Feed: 202303211930
Version 1.5 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.4 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.3 Dec 12, 2022, 4:05 PM CVSS metrics ("CVSSv2 score" changed from "5.0" to "7.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 score source (changed from "CVE-2022-0669" to "CVE-2021-3839") CVSSv2 severity (based on CVE-2021-3839, severity increased from "Medium" to "High") CVSSv3 score source (set to "CVE-2021-3839") Plugin Feed: 202212121605