Vulnerability · Published Sep 30, 2020 · Assigned by redhat

CVE-2020-14378

Low 3.3

In plain English

A low-severity security flaw in dpdk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.3Low

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	dpdk	19.11.5-1	DEBIAN-CVE-2020-14378
Debian:13	dpdk	19.11.5-1	DEBIAN-CVE-2020-14378
Debian:14	dpdk	19.11.5-1	DEBIAN-CVE-2020-14378

Affected products (as reported)

Vendor	Product	Versions
n/a	dpdk	All dpdk versions before 18.11.10 and before 19.11.5

Weakness: CWE-191

References

https://www.openwall.com/lists/oss-security/2020/09/28/3
https://bugzilla.redhat.com/show_bug.cgi?id=1879473
USN-4550-1 vendor-advisory
openSUSE-SU-2020:1593 vendor-advisory
openSUSE-SU-2020:1599 vendor-advisory
[oss-security] 20210104 Re: [dpdk-dev] DPDK security advisory for multiple vhost crypto issues mailing-list
[oss-security] 20210104 Re: DPDK security advisory for multiple vhost crypto issues mailing-list
[oss-security] 20210104 Re: [dpdk-dev] DPDK security advisory for multiple vhost crypto issues mailing-list