Log in Start free

Vulnerability · Published Dec 18, 2024 · Assigned by redhat

CVE-2024-11614Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library

High 7.4

In plain English

A high-severity out-of-bounds read in dpdk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.4High
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8dpdk23.11-2.el8_10ALSA-2025:0222
AlmaLinux:9dpdk2:23.11-2.el9_5ALSA-2025:0210
AlmaLinux:8dpdk-devel23.11-2.el8_10ALSA-2025:0222
AlmaLinux:9dpdk-devel2:23.11-2.el9_5ALSA-2025:0210
AlmaLinux:8dpdk-doc23.11-2.el8_10ALSA-2025:0222
AlmaLinux:9dpdk-doc2:23.11-2.el9_5ALSA-2025:0210
AlmaLinux:8dpdk-tools23.11-2.el8_10ALSA-2025:0222
AlmaLinux:9dpdk-tools2:23.11-2.el9_5ALSA-2025:0210
Debian:12dpdk22.11.7-1~deb12u1DEBIAN-CVE-2024-11614
Debian:12dpdk22.11.7-1~deb12u1DSA-5833-1
Debian:13dpdk24.11.1-1DEBIAN-CVE-2024-11614
Debian:14dpdk24.11.1-1DEBIAN-CVE-2024-11614
Rocky Linux:8dpdk0:23.11-2.el8_10RLSA-2025:0222
Rocky Linux:9dpdk2:23.11-2.el9_5RLSA-2025:0210
Ubuntu:22.04:LTSdpdk21.11.6-0ubuntu0.22.04.2USN-7178-1
Ubuntu:22.04:LTSdpdk21.11.6-0ubuntu0.22.04.2UBUNTU-CVE-2024-11614
Ubuntu:24.04:LTSdpdk23.11-1ubuntu0.1USN-7178-1
Ubuntu:24.04:LTSdpdk23.11-1ubuntu0.1UBUNTU-CVE-2024-11614

Affected products (as reported)

VendorProductVersions
dpdk 21.05 – before 21.11-4
Red Hat Fast Datapath for Red Hat Enterprise Linux 8 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references

Weakness: CWE-125 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References