Memory leak in DPDK - CVE-2020-10726

Vulnerability identifier: #VU27999

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10726

CWE-ID: CWE-401

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak, related to fd leak and vring index check. A remote attacker can force the application to leak memory and read sensitive information or perform denial of service attack.

DPDK
openvswitch (Red Hat package)
openvswitch2.10 (Red Hat package)
openvswitch2.11 (Red Hat package)
openvswitch2.12 (Red Hat package)
dpdk (Ubuntu package)
dpdk
dpdk (Red Hat package)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora

Install updates from vendor's website.

DPDK - addressed in versions 19.11.2, 20.02.1
openvswitch (Red Hat package) - update to 2.13.0-25.el8fdp.1
dpdk (Ubuntu package) - addressed in versions 17.11.9-0ubuntu18.04.2, 18.11.5-0ubuntu0.19.10.2, 19.11.1-0ubuntu1.1
dpdk - update to 19.11.1-2.fc32
dpdk (Red Hat package) - update to 19.11.3-1.el8

• http://doc.dpdk.org/guides-20.02/rel_notes/release_20_02.html
• https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html

• Multiple vulnerabilities in DPDK
• Ubuntu update for DPDK
• OpenSUSE Linux update for dpdk
• Red Hat Enterprise Linux Fast Datapath update for openvswitch
• Red Hat Enterprise Linux 8 update for dpdk
• Fedora 32 update for dpdk