Vulnerability · Published May 20, 2020 · Assigned by redhat

CVE-2020-10725

High 7.7

In plain English

A high-severity security flaw in dpdk from [UNKNOWN]. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)2.2%top 17.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	dpdk	19.11.2-1	DEBIAN-CVE-2020-10725
Debian:13	dpdk	19.11.2-1	DEBIAN-CVE-2020-10725
Debian:14	dpdk	19.11.2-1	DEBIAN-CVE-2020-10725

Affected products (as reported)

Vendor	Product	Versions
[UNKNOWN]	dpdk	20.02.119.11.2

Weakness: CWE-665 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References

openSUSE-SU-2020:0693 vendor-advisory, x_refsource_SUSE
FEDORA-2020-04e3d34451 vendor-advisory, x_refsource_FEDORA
https://www.openwall.com/lists/oss-security/2020/05/18/2 x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725 x_refsource_CONFIRM
https://bugs.dpdk.org/show_bug.cgi?id=270 x_refsource_MISC