CVE-2022-2132: High severity dpdk (data plane development kit) vulnerability
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
Other sources
In copydesctombuf() function, the Vhost header was assumed not across more than two descriptors. If a malicious guest send a packet with the Vhost header crossing more than two descriptors, the bufavail will be a very large number near 4G. All the mbufs will be allocated, therefor other guests traffic will be blocked. A malicious guest can cause denial of service for the other guest running on the hypervisor.
https://bugs.dpdk.org/showbug.cgi?id=1031
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-2132.
What is the severity of CVE-2022-2132?
The severity of CVE-2022-2132 is high with a CVSS score of 8.6.
What is the affected software for CVE-2022-2132?
The affected software for CVE-2022-2132 includes DPDK versions up to 21.11, openvswitch2.11 up to 2.17, and various Redhat Linux distributions.
How can I fix CVE-2022-2132?
To fix CVE-2022-2132, update DPDK to version 21.11 or apply the recommended patches for your specific software or distribution.
Where can I find more information on CVE-2022-2132?
You can find more information on CVE-2022-2132 in the provided references.