CVE-2020-10726: Integer Overflow
A vulnerability was found in DPDK through version 19.11, A malicious container which has direct access to the vhost-user socket can keep sending VHOSTUSERGETINFLIGHTFD messages which may cause leaking resources until resulting a DoS. Leaking resources being both file descriptors and virtual memory.
Other sources
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOSTUSERGETINFLIGHTFD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.
— Ubuntu
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this DPDK vulnerability?
The vulnerability ID for this DPDK vulnerability is CVE-2020-10726.
What is the severity of CVE-2020-10726?
The severity of CVE-2020-10726 is medium.
Which versions of DPDK are affected by this vulnerability?
DPDK versions 19.11 and above are affected by this vulnerability.
How can a malicious container exploit this vulnerability?
A malicious container with direct access to the vhost-user socket can exploit this vulnerability by sending VHOST_USER_GET_INFLIGHT_FD messages to cause a resource leak.
Is there a fix for CVE-2020-10726?
Yes, the recommended fix for CVE-2020-10726 is to upgrade to DPDK version 20.02.1 or apply the appropriate patches.