CVE-2022-0669
First published: Thu Feb 17 2022(Updated: )
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/dpdk | <22.03 | 22.03 |
| redhat/openvswitch2.13 | <0:2.13.0-180.el8fd | 0:2.13.0-180.el8fd |
| redhat/openvswitch2.15 | <0:2.15.0-99.el8fd | 0:2.15.0-99.el8fd |
| redhat/openvswitch2.16 | <0:2.16.0-74.el8fd | 0:2.16.0-74.el8fd |
| Dpdk Data Plane Development Kit | >=20.02<22.03 | |
| Dpdk Data Plane Development Kit | =19.11 | |
| Dpdk Data Plane Development Kit | =19.11-rc1 | |
| Dpdk Data Plane Development Kit | =19.11-rc2 | |
| Dpdk Data Plane Development Kit | =19.11-rc3 | |
| Dpdk Data Plane Development Kit | =19.11-rc4 | |
| Dpdk Data Plane Development Kit | =22.03-rc1 | |
| Dpdk Data Plane Development Kit | =22.03-rc2 | |
| Dpdk Data Plane Development Kit | =22.03-rc3 | |
| Openvswitch Openvswitch | =2.13.0 | |
| Openvswitch Openvswitch | =2.15.0 | |
| Redhat Openshift Container Platform | =4.0 | |
| debian/dpdk | 18.11.11-1~deb10u1 18.11.11-1~deb10u2 20.11.9-1~deb11u1 20.11.6-1~deb11u1 22.11.3-1~deb12u1 22.11.3-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-0669
- https://bugs.dpdk.org/show_bug.cgi?id=922
- https://bugzilla.redhat.com/show_bug.cgi?id=2055793
- https://github.com/DPDK/dpdk/commit/af74f7db384ed149fe42b21dbd7975f8a54ef227
- https://security-tracker.debian.org/tracker/CVE-2022-0669
- https://access.redhat.com/errata/RHSA-2022:4786
- https://access.redhat.com/errata/RHSA-2022:4787
- https://access.redhat.com/errata/RHSA-2022:4788
- https://access.redhat.com/security/cve/cve-2022-0669
- https://www.cve.org/CVERecord?id=CVE-2022-0669 https://nvd.nist.gov/vuln/detail/CVE-2022-0669
- https://github.com/DPDK/dpdk/commit/d87f1a1cb7b666550bb53e39c1d85d9f7b861e6f
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID of this flaw in dpdk?
The vulnerability ID is CVE-2022-0669.
What is the severity of CVE-2022-0669?
The severity of CVE-2022-0669 is medium.
Which software is affected by CVE-2022-0669?
The affected software includes dpdk, openvswitch2.13, openvswitch2.15, and openvswitch2.16.
How can a malicious primary vhost-user exploit CVE-2022-0669?
A malicious primary vhost-user can exploit CVE-2022-0669 by attaching an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the secondary vhost-user.
Are there any remedies available for CVE-2022-0669?
Yes, the remedy for dpdk is version 22.03 and for openvswitch2.13 it is version 0:2.13.0-180.el8fd, for openvswitch2.15 it is version 0:2.15.0-99.el8fd, and for openvswitch2.16 it is version 0:2.16.0-74.el8fd.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0669
- agent/software-canonical-lookup
- collector/redhat-cve
- collector/security-tracker-debian
- vendor/dpdk
- canonical/dpdk data plane development kit
- version/dpdk data plane development kit/20.02
- version/dpdk data plane development kit/19.11
- version/dpdk data plane development kit/19.11-rc1
- version/dpdk data plane development kit/19.11-rc2
- version/dpdk data plane development kit/19.11-rc3
- version/dpdk data plane development kit/19.11-rc4
- version/dpdk data plane development kit/22.03-rc1
- version/dpdk data plane development kit/22.03-rc2
- version/dpdk data plane development kit/22.03-rc3
- vendor/openvswitch
- canonical/openvswitch openvswitch
- version/openvswitch openvswitch/2.13.0
- version/openvswitch openvswitch/2.15.0
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/4.0
- package-manager/redhat
- package-manager/debian