An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.

According to the versions of the dpdk package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue     enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors     to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to     cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid     csum_start offset.(CVE-2024-11614)

Tenable has extracted the preceding description block directly from the EulerOS dpdk security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:0222 advisory.

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:0222 advisory.

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:0210 advisory.

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-0210 advisory.

    [23.11-2]
    - Backport fixes for CVE-2024-11614 (RHEL-68601)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-0222 advisory.

    [23.11-2]
    - Backport fixes for CVE-2024-11614 (RHEL-68600)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0210 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0211 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0221 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0209 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0222 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0220 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0208 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0018-1 advisory.

    - CVE-2024-11614: Fixed Denial Of Service from malicious guest on hypervisors using DPDK Vhost library     (bsc#1234718)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7178-1 advisory.

    It was discovered that DPDK incorrectly handled the Vhost library checksum offload feature. An malicious     guest could possibly use this issue to cause the hypervisor's vSwitch to crash, resulting in a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5833 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5833-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 17, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : dpdk     CVE ID         : CVE-2024-11614

    A buffer overflow was discovered in the vhost code of DPDK, a set of     libraries for fast packet processing, which could result in denial of     service or the execution of arbitrary code by malicious     guests/containers.

    For the stable distribution (bookworm), this problem has been fixed in     version 22.11.7-1~deb12u1.

    We recommend that you upgrade your dpdk packages.

    For the detailed security status of dpdk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dpdk

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216027	EulerOS 2.0 SP11 : dpdk (EulerOS-SA-2025-1154)	Nessus	Huawei Local Security Checks	high
215986	EulerOS 2.0 SP11 : dpdk (EulerOS-SA-2025-1135)	Nessus	Huawei Local Security Checks	high
213980	RockyLinux 8 : dpdk (RLSA-2025:0222)	Nessus	Rocky Linux Local Security Checks	high
213728	AlmaLinux 8 : dpdk (ALSA-2025:0222)	Nessus	Alma Linux Local Security Checks	high
213723	AlmaLinux 9 : dpdk (ALSA-2025:0210)	Nessus	Alma Linux Local Security Checks	high
213701	Oracle Linux 9 : dpdk (ELSA-2025-0210)	Nessus	Oracle Linux Local Security Checks	high
213699	Oracle Linux 8 : dpdk (ELSA-2025-0222)	Nessus	Oracle Linux Local Security Checks	high
213661	RHEL 9 : dpdk (RHSA-2025:0210)	Nessus	Red Hat Local Security Checks	high
213660	RHEL 9 : dpdk (RHSA-2025:0211)	Nessus	Red Hat Local Security Checks	high
213652	RHEL 8 : dpdk (RHSA-2025:0221)	Nessus	Red Hat Local Security Checks	high
213651	RHEL 9 : dpdk (RHSA-2025:0209)	Nessus	Red Hat Local Security Checks	high
213650	RHEL 8 : dpdk (RHSA-2025:0222)	Nessus	Red Hat Local Security Checks	high
213644	RHEL 8 : dpdk (RHSA-2025:0220)	Nessus	Red Hat Local Security Checks	high
213643	RHEL 9 : dpdk (RHSA-2025:0208)	Nessus	Red Hat Local Security Checks	high
213511	SUSE SLES15 / openSUSE 15 Security Update : dpdk (SUSE-SU-2025:0018-1)	Nessus	SuSE Local Security Checks	high
213261	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : DPDK vulnerability (USN-7178-1)	Nessus	Ubuntu Local Security Checks	high
213102	Debian dsa-5833 : dpdk - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-11614

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high