Integer overflow in DPDK - CVE-2020-14378

Vulnerability identifier: #VU47312

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14378

CWE-ID: CWE-190

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in the move_desc() function. A remote user on the guest OS can consume large amounts of CPU cycles and prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

DPDK
Opensuse
openEuler
Ubuntu
dpdk (Ubuntu package)
dpdk
dpdk-doc
dpdk-devel
dpdk-debugsource
dpdk-debuginfo
dpdk-tools

Install updates from vendor's website.

DPDK - addressed in versions 18.11.10, 19.11.5
dpdk (Ubuntu package) - update to 19.11.3-0ubuntu0.2
dpdk - update to 19.11-5
dpdk-doc - update to 19.11-5
dpdk-devel - update to 19.11-5
dpdk-debugsource - update to 19.11-5
dpdk-debuginfo - update to 19.11-5
dpdk-tools - update to 19.11-5

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1879473
• https://usn.ubuntu.com/4550-1/
• https://www.openwall.com/lists/oss-security/2020/09/28/3

• Multiple vulnerabilities in dpdk
• OpenSUSE Linux update for dpdk
• OpenSUSE Linux update for dpdk
• openEuler 20.03 LTS update for dpdk
• Ubuntu update for dpdk