Fast Datapath For Rhel 8
Monthly
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Host-side denial of service and potential memory corruption in DPDK's lib/vhost arise because memory-region sizes are not adequately validated before mmap during vhost memory-region setup (CWE-770). The affected code ships to customers through Red Hat Fast Datapath for RHEL 8, 9 and 10, and therefore reaches Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4 and Red Hat OpenStack Platform 13 (Queens) deployments that use DPDK vhost-user acceleration. An attacker who controls a connected vhost-user frontend - typically a guest VM or a process holding the vhost-user socket - can crash the host (CVSS 6.5, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).
An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Guest-to-host denial of service in the DPDK vhost library (lib/vhost) allows a malicious or misbehaving guest to underflow the copy length in the vhost enqueue path by supplying runt RX descriptors, which can stall or crash a shared host-side vhost backend such as OVS-DPDK. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, mapped to CWE-191) and is only reachable by an attacker who already controls a guest VM (local-to-host scope, PR:L) - not by a remote unauthenticated network attacker - with impact limited to availability (no confidentiality or integrity effect). No public exploit was identified at time of analysis and there is no CISA KEV listing for this CVE; no vendor-released patch was identified at the time of analysis.
Host-side denial of service and potential memory corruption in DPDK's lib/vhost arise because memory-region sizes are not adequately validated before mmap during vhost memory-region setup (CWE-770). The affected code ships to customers through Red Hat Fast Datapath for RHEL 8, 9 and 10, and therefore reaches Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4 and Red Hat OpenStack Platform 13 (Queens) deployments that use DPDK vhost-user acceleration. An attacker who controls a connected vhost-user frontend - typically a guest VM or a process holding the vhost-user socket - can crash the host (CVSS 6.5, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation.
A time-of-check/time-of-use race in the DPDK vhost library's handling of virtio indirect descriptor tables allows an attacker who already controls a guest VM attached to a DPDK vhost-user backend to crash or disrupt the host vhost process by mutating the descriptor table length between the host's two reads from guest memory, or by supplying an out-of-range next index against a small host-side copy in the vDPA relay path. Exploitation requires local/guest-level low privilege (PR:L) and is heavily timing-dependent (AC:H), and the impact is confined to availability - the out-of-bounds bytes are consumed internally as descriptor fields for GPA translation and are never returned to the guest as payload, so no confidentiality or integrity loss is assessed. This is a moderate, defense-in-depth-class residual of the CVE-2018-1059 fix rather than an urgent priority, and no public exploit code was identified at time of analysis.