DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries
DPDK patched guest-triggerable memory-safety flaws in vhost, vhost-crypto, vDPA, and GSO.
The DPDK project fixed multiple memory-safety vulnerabilities in its vhost, vhost-crypto, vDPA, and GSO libraries after advance notice to downstream stakeholders. A malicious guest can exploit the flaws, including across the vhost-user boundary, to crash the host, cause denial of service, or potentially corrupt memory. The published notice does not list CVE identifiers and does not say exploitation has been observed.
- Fixes cover DPDK vhost, vhost-crypto, vDPA, and GSO libraries.
- A malicious guest may crash the host or corrupt memory.
- Some issues can be triggered across the vhost-user boundary.
- No CVE identifiers or observed exploitation are stated.
Posted by Maxime Coquelin on Oct 14 Multiple vulnerabilities were fixed in DPDK. Downstream stakeholders were warned in advance in order to coordinate the release of fixes and reduce the vulnerability window. A malicious guest can exploit various memory safety issues in the DPDK vhost, vhost-crypto, vDPA, and GSO libraries to cause host crashes, denial of service, or potential memory corruption. Some of these vulnerabilities affect the vhost-user boundary and can be triggered...
This source does not provide full text. Read it at seclists.org.