CVE-2022-28199: Input Validation
A vulnerability was fixed in DPDK. When having a failure with the mlx5 driver, the error recovery was not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.
Commits per branch: main - https://git.dpdk.org/dpdk/commit/?id=60b254e392 21.11 - https://git.dpdk.org/dpdk-stable/commit/?id=25c01bd323 20.11 - https://git.dpdk.org/dpdk-stable/commit/?id=ef311075d2 19.11 - https://git.dpdk.org/dpdk-stable/commit/?id=8b090f2664
LTS Releases: 21.11 - http://fast.dpdk.org/rel/dpdk-21.11.2.tar.xz 20.11 - http://fast.dpdk.org/rel/dpdk-20.11.6.tar.xz 19.11 - http://fast.dpdk.org/rel/dpdk-19.11.13.tar.xz
Other sources
A vulnerability was found in the DPDK package. Affected versions of this package are vulnerable to denial of service (DoS) attacks, affecting system availability.
NVIDIA’s distribution of the Data Plane Development Kit (MLNXDPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openvswitch2.13to a version that resolves this vulnerability.Fixed in 0:2.13.0-193.3.el8fd - Upgrade
Upgrade
redhat/openvswitch2.17to a version that resolves this vulnerability.Fixed in 0:2.17.0-37.4.el8fd - Upgrade
Upgrade
redhat/openvswitch2.15to a version that resolves this vulnerability.Fixed in 0:2.15.0-113.3.el8fd - Upgrade
Upgrade
redhat/openvswitch2.16to a version that resolves this vulnerability.Fixed in 0:2.16.0-89.3.el8fd - Upgrade
Upgrade
redhat/openvswitch2.17to a version that resolves this vulnerability.Fixed in 0:2.17.0-32.4.el9fd - Upgrade
Upgrade
redhat/dpdkto a version that resolves this vulnerability.Fixed in 2:21.11.2-1.el9_1 - Upgrade
Upgrade
redhat/dpdkto a version that resolves this vulnerability.Fixed in 21.11.2 - Upgrade
Upgrade
redhat/dpdkto a version that resolves this vulnerability.Fixed in 20.11.6 - Upgrade
Upgrade
redhat/dpdkto a version that resolves this vulnerability.Fixed in 19.11.13 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 22.11.11-0+deb12u1Fixed in 22.11.7-1~deb12u1Fixed in 24.11.4-0+deb13u1Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 22.11.1-2 - Upgrade
Upgrade
DPDKto a version that resolves this vulnerability.Fixed in 19.11.13 - Upgrade
Upgrade
DPDKto a version that resolves this vulnerability.Fixed in 20.11.6 - Upgrade
Upgrade
DPDKto a version that resolves this vulnerability.Fixed in 21.11.2 - Upgrade
Upgrade
MLNX_DPDKto a version that resolves this vulnerability.Patch 60b254e392
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-28199?
CVE-2022-28199 has a severity level that can lead to denial of service and impact data integrity and confidentiality.
How do I fix CVE-2022-28199?
To fix CVE-2022-28199, upgrade to the appropriate versions of DPDK or Open vSwitch as specified in the remediation section.
What software is affected by CVE-2022-28199?
CVE-2022-28199 affects certain versions of DPDK and Open vSwitch as specified in the vulnerability report.
What types of attacks can exploit CVE-2022-28199?
CVE-2022-28199 can be exploited by remote attackers to potentially cause denial of service.
Is CVE-2022-28199 related to specific drivers?
Yes, CVE-2022-28199 is specifically related to a failure in the mlx5 driver during error recovery.