Dpdk
Monthly
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.
A permissive list of allowed inputs flaw was found in DPDK. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in dpdk. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.8). This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.8).
A vulnerability was found in DPDK versions 19.11 and above. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in DPDK versions 18.11 and above. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A memory corruption issue was found in DPDK versions 17.05 and above. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability was found in DPDK versions 18.05 and above. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required. No vendor patch available.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.
A permissive list of allowed inputs flaw was found in DPDK. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in dpdk. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.8). This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Rated high severity (CVSS 7.8).
A vulnerability was found in DPDK versions 19.11 and above. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in DPDK versions 18.11 and above. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A memory corruption issue was found in DPDK versions 17.05 and above. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A vulnerability was found in DPDK versions 18.05 and above. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses. Rated medium severity (CVSS 6.1), this vulnerability is no authentication required. No vendor patch available.