Buffer overflow in DPDK - CVE-2020-14376

Vulnerability identifier: #VU47310

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14376

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when copying iv_data from the VM guest memory into host memory. A remote user on the guest OS can  run a specially crafted program to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

DPDK
Opensuse
openEuler
Ubuntu
dpdk (Ubuntu package)
dpdk
dpdk-doc
dpdk-devel
dpdk-debugsource
dpdk-debuginfo
dpdk-tools

Install updates from vendor's website.

DPDK - addressed in versions 18.11.10, 19.11.5
dpdk (Ubuntu package) - update to 19.11.3-0ubuntu0.2
dpdk - update to 19.11-5
dpdk-doc - update to 19.11-5
dpdk-devel - update to 19.11-5
dpdk-debugsource - update to 19.11-5
dpdk-debuginfo - update to 19.11-5
dpdk-tools - update to 19.11-5

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1879470
• https://usn.ubuntu.com/4550-1/
• https://www.openwall.com/lists/oss-security/2020/09/28/3

• Multiple vulnerabilities in dpdk
• OpenSUSE Linux update for dpdk
• OpenSUSE Linux update for dpdk
• openEuler 20.03 LTS update for dpdk
• Ubuntu update for dpdk