PT-2022-7553 · Dpdk+5 · Dpdk+5

Michael Kaplan · Published 2022-01-20 · Updated 2023-07-26 · CVE-2022-0669

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DPDK (affected versions not specified)

Description The issue is related to an uncontrolled resource consumption in the DPDK library and driver set, which can lead to a denial of service. A malicious vhost-user master can attach an unexpected number of file descriptors as ancillary data to VHOST USER GET INFLIGHT FD and VHOST USER SET INFLIGHT FD messages, causing the vhost-user slave process to exhaust available file descriptors when these messages are sent continuously.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2023-4553

BDU:2024-07307

CVE-2022-0669

DSA-5130-1

OESA-2022-1713

OPENSUSE-SU-2022_1892-1

OPENSUSE-SU-2024:12039-1

RHSA-2022:4786

RHSA-2022:4787

RHSA-2022:4788

SUSE-SU-2022:1892-1

SUSE-SU-2022:2273-1

USN-5401-1

Affected Products

Alt Linux

Astra Linux

Dpdk

Linuxmint

Suse

Ubuntu

References · 32

• https://github.com/DPDK/dpdk/commit/af74f7db384ed149fe42b21dbd7975f8a54ef227 · Patch
• https://ubuntu.com/security/notices/USN-5401-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0669 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1713 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0669 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2273-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5401-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2055793 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0669 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0669 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5130-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07307 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-0669 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3839 · Security Note