PT-2019-6439 · Intel+8 · Dpdk+8

Wenxiang Qian · Published 2019-10-23 · Updated 2023-07-26 · CVE-2021-3839

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions DPDK (affected versions not specified)

Description A flaw was found in the vhost library in DPDK. The function vhost user set inflight fd() does not validate msg->payload.inflight.num queues, possibly causing out-of-bounds memory read/write. This could result in a crash of any software using the DPDK vhost library. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

ALSA-2022:8263

ALT-PU-2023-4553

BDU:2024-07304

CVE-2021-3839

DSA-5130-1

OESA-2022-1713

OPENSUSE-SU-2022_1892-1

RHSA-2022:4786

RHSA-2022:4787

RHSA-2022:4788

RHSA-2022:8263

RHSA-2022_8263

RLSA-2022:8263

SUSE-SU-2022:1892-1

SUSE-SU-2022:2273-1

SUSE-SU-2022_1892-1

SUSE-SU-2022_2273-1

USN-5401-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Dpdk

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 47

• https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5 · Patch
• https://osv.dev/vulnerability/OESA-2022-1713 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:8263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0669 · Security Note
• https://errata.rockylinux.org/RLSA-2022:8263 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3839 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07304 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3839 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3839 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2273-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3839 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5130-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3839 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8263.html · Vendor Advisory