A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.

The remote NewStart CGSL host, running version MAIN 6.02, has dpdk packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation     fault of the vhost-user backend application running on the host, which could result in a loss of     connectivity for the other guests running on that host. This is caused by a missing validity check of the     descriptor address in the function `virtio_dev_rx_batch_packed()`. (CVE-2020-10725)

  - A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access     to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak     (file descriptors and virtual memory), which may result in a denial of service. (CVE-2020-10726)

  - A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in     vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory     corruption. (CVE-2020-10722)

  - A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer     truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and     truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.
    (CVE-2020-10723)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4806 advisory.

  - dpdk: librte_vhost Integer overflow in vhost_user_set_log_base() (CVE-2020-10722)

  - dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

  - dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

  - dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4806 advisory.

    [19.11.3-1]
    - Rebase DPDK to 19.11.3 (#1868708)

    [19.11.2-1]
    - Rebase DPDK to 19.11.2 (#1836830, #1837024, #1837030, #1837022)

    [19.11.1-1]
    - Rebase DPDK to 19.11.1 (#1824905)
    - Remove dpdk-pmdinfo.py (#1801361)
    - Add Requires: rdma-core-devel libmnl-devel on x86_64 for dpdk-devel (#1813252)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4806 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    The following packages have been upgraded to a later upstream version: dpdk (19.11.3). (BZ#1824905)

    Security Fix(es):

    * dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

    * dpdk: librte_vhost Integer overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix cvws CVE-2020-10726,CVE-2020-10724,CVE-2020-10723,CVE-2020-10722,CVE-2020-1 0725

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2295 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

    * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

    * dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * DPDK virtio_user lack of notifications make vhost_net+napi stops tx buffers (BZ#1803082)

    * Update internal DPDK to 19.11.1 (BZ#1824825)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for dpdk fixes the following issues :

Security issues fixed :

  - CVE-2020-10722: Fixed an integer overflow in     vhost_user_set_log_base() (bsc#1171477).

  - CVE-2020-10723: Fixed an integer truncation in     vhost_user_check_and_alloc_queue_pair() (bsc#1171477).

  - CVE-2020-10724: Fixed a missing inputs validation in     Vhost-crypto (bsc#1171477).

  - CVE-2020-10725: Fixed a segfault caused by invalid     virtio descriptors sent from a malicious guest     (bsc#1171477).

  - CVE-2020-10726: Fixed a denial-of-service caused by     VHOST_USER_GET_INFLIGHT_FD message flooding     (bsc#1171477).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dpdk fixes the following issues :

Security issues fixed :

CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477).

CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).

CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477).

CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477).

CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4362-1 advisory.

    It was discovered that DPDK incorrectly handled certain inputs. An attacker could possibly use this issue     to cause a crash or execute arbitrary code. (CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,     CVE-2020-10725, CVE-2020-10726)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
147295	NewStart CGSL MAIN 6.02 : dpdk Multiple Vulnerabilities (NS-SA-2021-0073)	Nessus	NewStart CGSL Local Security Checks	medium
145980	CentOS 8 : dpdk (CESA-2020:4806)	Nessus	CentOS Local Security Checks	medium
142795	Oracle Linux 8 : dpdk (ELSA-2020-4806)	Nessus	Oracle Linux Local Security Checks	medium
142390	RHEL 8 : dpdk (RHSA-2020:4806)	Nessus	Red Hat Local Security Checks	medium
137103	Fedora 32 : 2:dpdk (2020-04e3d34451)	Nessus	Fedora Local Security Checks	medium
136899	RHEL 8 : openvswitch2.13 (RHSA-2020:2295)	Nessus	Red Hat Local Security Checks	medium
136882	openSUSE Security Update : dpdk (openSUSE-2020-693)	Nessus	SuSE Local Security Checks	medium
136795	SUSE SLED15 / SLES15 Security Update : dpdk (SUSE-SU-2020:1335-1)	Nessus	SuSE Local Security Checks	medium
136709	Ubuntu 18.04 LTS / 20.04 LTS : DPDK vulnerabilities (USN-4362-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-10726

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium