CVE-2019-14818

State: Published
Severity: 7.5 High
Published: Nov 14, 2019
Updated: Aug 5, 2024
Reserved: Aug 10, 2019

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-401

Affected Products

Product	Versions
dpdkDPDK	all dpdk version 17.x.x before 17.11.8Affected all dpdk version 16.x.x before 16.11.10Affected all dpdk version 18.x.x before 18.11.4Affected all dpdk version 19.x.x before 19.08.1Affected

References

FEDORA-2019-019df9a459vendor-advisory
RHSA-2020:0166vendor-advisory
RHSA-2020:0165vendor-advisory
RHSA-2020:0168vendor-advisory
RHSA-2020:0172vendor-advisory
RHSA-2020:0171vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
https://bugs.dpdk.org/show_bug.cgi?id=363

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.