CVE-2020-10723: Integer Overflow

A vulnerability was found in DPDK through version 18.11, vhostusercheckandallocqueuepair() is used to extract a vring index from a payload. This function validates the index and is called early on in when performing message handling. Most message handlers depend on it correctly validating the vring index. Depending on the message type the vring index is in different parts of the payload. The function contains a switch/case for each type and copies the index. This is stored in a uint16. This index is then validated. Depending on the message, the source index is an unsigned int. If integer truncation occurs (uint->uint16) the top 16 bits of the index are never validated. When they are used later on (e.g. in vhostusersetvringnum() or vhostusersetvringaddr()) it can lead to out of bound indexing. The out of bound indexed data gets written to, and hence this can cause memory corruption.

— Red Hat