Out-of-bounds write in DPDK - CVE-2021-3839

Vulnerability identifier: #VU63625

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2021-3839

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to vhost_user_set_inflight_fd() function does not validate msg->payload.inflight.num_queues. A local user can trigger out-of-bounds write and execute arbitrary code with elevated privileges.

DPDK
Debian Linux
Oracle Linux
SUSE Manager Server
SUSE Manager Proxy
Red Hat Enterprise Linux Fast Datapath (for RHEL for ARM 64)
Red Hat Enterprise Linux Fast Datapath (for IBM z Systems)
Red Hat Enterprise Linux Fast Datapath (for RHEL Server for IBM Power LE)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Ubuntu
openvswitch2.16 (Red Hat package)
openvswitch2.13 (Red Hat package)
openvswitch2.15 (Red Hat package)
dpdk-kmp-preempt
dpdk-kmp-preempt-debuginfo
dpdk-thunderx-kmp-preempt
dpdk-thunderx-kmp-preempt-debuginfo
dpdk-thunderx-kmp-default-debuginfo
dpdk-thunderx-kmp-default
dpdk-kmp-default-debuginfo
dpdk-kmp-default
dpdk-thunderx
libdpdk-20_0-debuginfo
dpdk-thunderx-debuginfo
dpdk-thunderx-debugsource
dpdk-thunderx-devel
dpdk-thunderx-devel-debuginfo
dpdk-thunderx-examples
dpdk-thunderx-examples-debuginfo
dpdk-thunderx-tools
dpdk-thunderx-tools-debuginfo
dpdk-doc
dpdk-thunderx-doc
libdpdk-20_0
dpdk
dpdk-debuginfo
dpdk-debugsource
dpdk-devel
dpdk-devel-debuginfo
dpdk-examples
dpdk-examples-debuginfo
dpdk-tools
dpdk-tools-debuginfo
dpdk (Ubuntu package)
dpdk (Debian package)
dpdk (Red Hat package)
Red Hat Enterprise Linux Fast Datapath

Install updates from vendor's website.

DPDK - update to 22.03
openvswitch2.16 (Red Hat package) - update to 2.16.0-74.el8fdp
openvswitch2.13 (Red Hat package) - update to 2.13.0-180.el8fdp
openvswitch2.15 (Red Hat package) - update to 2.15.0-99.el8fdp
dpdk-kmp-preempt - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-kmp-preempt-debuginfo - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-thunderx-kmp-preempt - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-thunderx-kmp-preempt-debuginfo - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-thunderx-kmp-default-debuginfo - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-thunderx-kmp-default - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-kmp-default-debuginfo - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-kmp-default - update to 19.11.4_k5.3.18_150300.59.63-150300.11.1
dpdk-thunderx - update to 19.11.4-150300.11.1
libdpdk-20_0-debuginfo - update to 19.11.4-150300.11.1
dpdk-thunderx-debuginfo - update to 19.11.4-150300.11.1
dpdk-thunderx-debugsource - update to 19.11.4-150300.11.1
dpdk-thunderx-devel - update to 19.11.4-150300.11.1
dpdk-thunderx-devel-debuginfo - update to 19.11.4-150300.11.1
dpdk-thunderx-examples - update to 19.11.4-150300.11.1
dpdk-thunderx-examples-debuginfo - update to 19.11.4-150300.11.1
dpdk-thunderx-tools - update to 19.11.4-150300.11.1
dpdk-thunderx-tools-debuginfo - update to 19.11.4-150300.11.1
dpdk-doc - update to 19.11.4-150300.11.1
dpdk-thunderx-doc - update to 19.11.4-150300.11.1
libdpdk-20_0 - update to 19.11.4-150300.11.1
dpdk - update to 19.11.4-150300.11.1
dpdk-debuginfo - update to 19.11.4-150300.11.1
dpdk-debugsource - update to 19.11.4-150300.11.1
dpdk-devel - update to 19.11.4-150300.11.1
dpdk-devel-debuginfo - update to 19.11.4-150300.11.1
dpdk-examples - update to 19.11.4-150300.11.1
dpdk-examples-debuginfo - update to 19.11.4-150300.11.1
dpdk-tools - update to 19.11.4-150300.11.1
dpdk-tools-debuginfo - update to 19.11.4-150300.11.1
dpdk (Ubuntu package) - addressed in versions 19.11.12-0ubuntu0.20.04.1, 20.11.5-0ubuntu1, 21.11.1-0ubuntu0.3
dpdk - update to 19.11-17
dpdk-tools - update to 19.11-17
dpdk-debuginfo - update to 19.11-17
dpdk-debugsource - update to 19.11-17
dpdk-devel - update to 19.11-17
dpdk-doc - update to 19.11-17
dpdk (Debian package) - update to 20.11.5-1~deb11u1
dpdk (Red Hat package) - update to 21.11.2-1.el9_1

• https://bugzilla.redhat.com/show_bug.cgi?id=2025882

• Privilege escalation in DPDK
• Ubuntu update for dpdk
• Red Hat Enterprise Linux Fast Datapath 8 update for openvswitch
• Debian update for dpdk
• Red Hat Enterprise Linux 9 update for dpdk
• SUSE update for dpdk
• Multiple vulnerabilities in Oracle Linux
• openEuler update for dpdk
• Fast Datapath for Red Hat Enterprise Linux 8 update for openvswitch2.15
• Fast Datapath for Red Hat Enterprise Linux 8 update for openvswitch2.13