CVE-2021-3839: High severity dpdk (data plane development kit) vulnerability
A flaw was found in the vhost library in DPDK. Function vhostusersetinflightfd() does not validate msg->payload.inflight.numqueues, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Other sources
In function vhostusersetinflightfd() which is in DPDK Vhost library, msg->payload.inflight.numqueues doesn't get checked to determine if it's out of bounds. So it could cause the program to write/read out of boundary. And in the end the software using DPDK Vhost library may crash.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3839?
CVE-2021-3839 is a vulnerability in the vhost library in DPDK that can cause out-of-bounds memory read/write, potentially leading to a crash.
What is the severity level of CVE-2021-3839?
The severity level of CVE-2021-3839 is high, with a CVSS score of 7.5.
Which software is affected by CVE-2021-3839?
Any software using DPDK vhost library may be affected by CVE-2021-3839.
How can I fix CVE-2021-3839?
To fix CVE-2021-3839, upgrade to DPDK version 22.03 or apply the relevant patches provided by Red Hat.
Where can I find more information about CVE-2021-3839?
You can find more information about CVE-2021-3839 in the references provided: [link1](https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2081486), [link3](https://access.redhat.com/errata/RHSA-2022:4786).