Input validation error - CVE-2019-14818

Vulnerability identifier: #VU50124

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14818

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

python-openstacksdk (Red Hat package)
python-hardware (Red Hat package)
ansible-role-redhat-subscription (Red Hat package)
openstack-octavia-ui (Red Hat package)
python-novajoin (Red Hat package)
python-octavia-tests-tempest (Red Hat package)
python-os-vif (Red Hat package)
python-neutron-lib (Red Hat package)
python-tempestconf (Red Hat package)
openvswitch (Alpine package)
rabbitmq-server (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-openstackclient (Red Hat package)
python-keystonemiddleware (Red Hat package)
openstack-manila (Red Hat package)
rhosp-release (Red Hat package)
openstack-tempest (Red Hat package)
python-barbican-tests-tempest (Red Hat package)
python-ovsdbapp (Red Hat package)
python-os-testr (Red Hat package)
openvswitch (Red Hat package)
openvswitch2.11 (Red Hat package)
openvswitch2.12 (Red Hat package)
dpdk
dpdk (Red Hat package)
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Fedora
Red Hat Enterprise Linux Fast Datapath
Red Hat OpenStack Director Deployment Tools
Red Hat OpenStack for IBM Power
Red Hat OpenStack

Install update from vendor's website.

python-openstacksdk (Red Hat package) - update to 0.11.4-1.el7ost
python-hardware (Red Hat package) - update to 0.23.0-0.20200117070144.59211cc.el7ost
ansible-role-redhat-subscription (Red Hat package) - update to 1.0.4-2.el7ost
openstack-octavia-ui (Red Hat package) - update to 1.0.2-1.el7ost
python-novajoin (Red Hat package) - update to 1.3.0-1.el7ost
python-octavia-tests-tempest (Red Hat package) - update to 1.1.0-1.el7ost
python-os-vif (Red Hat package) - update to 1.9.2-1.el7ost
python-neutron-lib (Red Hat package) - update to 1.13.0-2.el7ost
python-tempestconf (Red Hat package) - update to 2.4.0-1.el7ost
openvswitch (Alpine package) - update to 2.12.2-r0
rabbitmq-server (Red Hat package) - update to 3.6.15-6.el7ost
python-keystoneauth1 (Red Hat package) - update to 3.4.1-2.el7ost
python-openstackclient (Red Hat package) - update to 3.14.3-5.el7ost
python-keystonemiddleware (Red Hat package) - update to 4.22.0-1.el7ost
openstack-manila (Red Hat package) - update to 6.3.2-1.el7ost
rhosp-release (Red Hat package) - update to 13.0.11-1.el7ost
openstack-tempest (Red Hat package) - update to 18.0.0-13.el7ost
python-barbican-tests-tempest (Red Hat package) - update to 0.1.0-0.20180828144800.b8bf147.el7ost
python-ovsdbapp (Red Hat package) - update to 0.10.4-2.el7ost
python-os-testr (Red Hat package) - update to 1.0.1-0.20200218144109.7dd678e.el7ost
openvswitch (Red Hat package) - update to 2.9.0-124.el7fdp
openvswitch2.11 (Red Hat package) - addressed in versions 2.11.0-35.el7fdp, 2.11.0-35.el8fdp
openvswitch2.12 (Red Hat package) - addressed in versions 2.12.0-12.el7fdp, 2.12.0-12.el8fdp
dpdk - update to 18.11.2-3.fc31
dpdk (Red Hat package) - addressed in versions 18.11.5-1.el7_8, 19.11-4.el8

• https://access.redhat.com/errata/RHSA-2020:0165
• https://access.redhat.com/errata/RHSA-2020:0166
• https://access.redhat.com/errata/RHSA-2020:0168
• https://access.redhat.com/errata/RHSA-2020:0171
• https://access.redhat.com/errata/RHSA-2020:0172
• https://bugs.dpdk.org/show_bug.cgi?id=363
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/

• Input validation error in openvswitch (Alpine package)
• Red Hat update for OpenStack Platform 13.0 (Queens) for RHEL 7
• Fast Datapath for RHEL 7 update for openvswitch
• Fast Datapath for RHEL 7 update for openvswitch2.11
• Fast Datapath for RHEL 7 update for openvswitch2.12
• Fast Datapath for RHEL 8 update for openvswitch2.11
• Fast Datapath for RHEL 8 update for openvswitch2.12
• Red Hat Enterprise Linux 7 Extras update for dpdk
• Red Hat Enterprise Linux 8 update for dpdk
• Fedora 31 update for dpdk