CVE-2020-14378: Integer Underflow
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.
Other sources
An integer underflow in the movedesc function can lead to many cpu cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295 iteration loop. Depending on how vhostcrypto is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14378?
CVE-2020-14378 is an integer underflow vulnerability in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function.
What is the severity of CVE-2020-14378?
CVE-2020-14378 has a severity level of 3.3 (low).
How can CVE-2020-14378 be exploited?
An attacker could cause the `move_desc` function of dpdk to get stuck in a 4,294,967,295-count iteration loop.
Which versions of dpdk are affected by CVE-2020-14378?
dpdk versions before 18.11.10 and before 19.11.5 are affected by CVE-2020-14378.
How can I fix CVE-2020-14378?
To fix CVE-2020-14378, update dpdk to version 18.11.10 or later, or version 19.11.5 or later.