PT-2020-3618 · Intel+4 · Dpdk+4

Published 2019-06-08 · Updated 2021-10-19 · CVE-2020-10724

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions DPDK versions 18.11 and above

Description A vulnerability in the vhost-crypto library code is related to missing validations for user-supplied values. This could potentially allow an information leak through an out-of-bounds memory read. The issue is also associated with an integer overflow, which may enable an attacker to access confidential data.

Recommendations For DPDK versions 18.11 and above, consider disabling the vhost-crypto library until a patch is available to prevent potential information leaks. Restrict access to user-supplied values to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Out of bounds Read

Weakness Enumeration

CWE-190

CWE-125

Related Identifiers

ALT-PU-2019-2018

ALT-PU-2019-2030

ALT-PU-2020-2208

ALT-PU-2020-2214

ALT-PU-2020-2878

ALT-PU-2021-1176

ALT-PU-2021-2053

AZL-38527

BDU:2020-03962

CVE-2020-10724

DSA-4688-1

OPENSUSE-SU-2020:0693-1

OPENSUSE-SU-2020_0693-1

RHSA-2020:2295

RHSA-2020:2296

RHSA-2020:2297

RHSA-2021:0931

SUSE-SU-2020:1334-1

SUSE-SU-2020:1335-1

SUSE-SU-2020:1552-1

SUSE-SU-2020_1552-1

USN-4362-1

Affected Products

Alt Linux

Dpdk

Linuxmint

Suse

Ubuntu

References · 45

• https://security-tracker.debian.org/tracker/CVE-2020-10724 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10723 · Vendor Advisory
• https://usn.ubuntu.com/4362-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10724 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4362-1 · Vendor Advisory
• https://bugs.dpdk.org/show_bug.cgi?id=269 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38527 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4688-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4362-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10724 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10724 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03962 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10724 · Security Note