Input validation error in DPDK - CVE-2020-10723

Vulnerability identifier: #VU27996

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10723

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of translated addresses. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

DPDK
openvswitch (Red Hat package)
openvswitch2.10 (Red Hat package)
openvswitch2.11 (Red Hat package)
ovn2.11 (Red Hat package)
openvswitch (Alpine package)
openvswitch2.12 (Red Hat package)
dpdk (Debian package)
dpdk (Ubuntu package)
ovirt-ansible-repositories (Red Hat package)
python-ovirt-engine-sdk4 (Red Hat package)
dpdk (Red Hat package)
dpdk
Oracle Enterprise Communications Broker
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
Red Hat Virtualization Host
Red Hat Virtualization Manager
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
Red Hat Enterprise Linux Fast Datapath

Install updates from vendor's website.

DPDK - addressed in versions 19.11.2, 20.02.1
openvswitch (Red Hat package) - addressed in versions 2.9.0-130.el7fdp, 2.13.0-25.el8fdp.1
openvswitch2.11 (Red Hat package) - addressed in versions 2.11.0-54.20200327gita4efc59.el7fdp, 2.11.0-54.20200327gita4efc59.el8fdp
ovn2.11 (Red Hat package) - update to 2.11.1-44.el7fdp
openvswitch (Alpine package) - update to 2.12.2-r0
dpdk (Debian package) - addressed in versions 16.11.11-1+deb9u2, 18.11.6-1~deb10u2, 19.11.2-1
dpdk (Ubuntu package) - addressed in versions 17.11.9-0ubuntu18.04.2, 18.11.5-0ubuntu0.19.10.2, 19.11.1-0ubuntu1.1
ovirt-ansible-repositories (Red Hat package) - update to 1.1.6-1.el7ev
python-ovirt-engine-sdk4 (Red Hat package) - update to 4.3.4-1.el7ev
dpdk (Red Hat package) - addressed in versions 18.11.8-1.el7_8, 19.11.3-1.el8
dpdk - update to 19.11.1-2.fc32

• http://doc.dpdk.org/guides-20.02/rel_notes/release_20_02.html
• https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html

• Multiple vulnerabilities in DPDK
• Debian update for dpdk
• Ubuntu update for DPDK
• OpenSUSE Linux update for dpdk
• Red Hat Enterprise Linux Fast Datapath update for openvswitch
• Fast Datapath for Red Hat Enterprise Linux 7 update for openvswitch2.11
• Fast Datapath for Red Hat Enterprise Linux 8 update for openvswitch2.11
• Red Hat update for openvswitch
• Multiple vulnerabilities in Red Hat Virtualization 4 for RHEL 7
• Red Hat Enterprise Linux 8 update for dpdk
• Multiple vulnerabilities in Oracle Enterprise Communications Broker
• Input validation error in openvswitch (Alpine package)
• Red Hat Enterprise Linux 7 Extras update for dpdk
• Fedora 32 update for dpdk