PT-2020-13989 · Intel+4 · Dpdk+4

Ryan Hall · Published 2020-09-28 · Updated 2024-06-15 · CVE-2020-14378

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions dpdk versions prior to 18.11.10 dpdk versions prior to 19.11.5

Description An integer underflow in the move desc function can cause large amounts of CPU cycles to be consumed in a long-running loop. An attacker could cause move desc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhost crypto is used, this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

Recommendations For dpdk versions prior to 18.11.10, update to version 18.11.10 or later to resolve the issue. For dpdk versions prior to 19.11.5, update to version 19.11.5 or later to resolve the issue. As a temporary workaround, consider disabling the move desc function until a patch is available. Restrict access to the vhost crypto module to minimize the risk of exploitation.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2020-3518

ALT-PU-2021-1176

ALT-PU-2021-2053

AZL-38821

CVE-2020-14378

OPENSUSE-SU-2020:1593-1

OPENSUSE-SU-2020:1599-1

OPENSUSE-SU-2020_1593-1

OPENSUSE-SU-2020_1599-1

OPENSUSE-SU-2024:10727-1

SUSE-SU-2020:2767-1

SUSE-SU-2020:2768-1

SUSE-SU-2020:2769-1

SUSE-SU-2020:2770-1

USN-4550-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Dpdk

References · 45

• https://ubuntu.com/security/CVE-2020-14376 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/28/3 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1599-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38821 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14378 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14378 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4550-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14378 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2769-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4550-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1593-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2768-1 · Vendor Advisory