Buffer overflow in DPDK - CVE-2020-14374

Vulnerability identifier: #VU47308

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14374

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the copy_data() function. A remote user on a guest OS can run a specially crafted program to trigger memory corruption vhost_crypto application and execute arbitrary code on the host system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

DPDK
Opensuse
openEuler
Ubuntu
dpdk (Ubuntu package)
dpdk
dpdk-doc
dpdk-devel
dpdk-debugsource
dpdk-debuginfo
dpdk-tools

Install updates from vendor's website.

DPDK - addressed in versions 18.11.10, 19.11.5
dpdk (Ubuntu package) - update to 19.11.3-0ubuntu0.2
dpdk - update to 19.11-5
dpdk-doc - update to 19.11-5
dpdk-devel - update to 19.11-5
dpdk-debugsource - update to 19.11-5
dpdk-debuginfo - update to 19.11-5
dpdk-tools - update to 19.11-5

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1879466
• https://www.openwall.com/lists/oss-security/2020/09/28/3

• Multiple vulnerabilities in dpdk
• OpenSUSE Linux update for dpdk
• OpenSUSE Linux update for dpdk
• openEuler 20.03 LTS update for dpdk
• Ubuntu update for dpdk