CVE-2024-11614: Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library
First published: Fri Nov 22 2024(Updated: )
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/dpdk | <=22.11.6-1~deb12u1<=23.11.2-3 | 20.11.10-1~deb11u1 20.11.6-1~deb11u1 22.11.7-1~deb12u1 24.11.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2024-11614
- https://bugzilla.redhat.com/show_bug.cgi?id=2327955
- http://www.openwall.com/lists/oss-security/2024/12/17/3
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11614
- https://nvd.nist.gov/vuln/detail/CVE-2024-11614
- https://launchpad.net/bugs/cve/CVE-2024-11614
- https://security-tracker.debian.org/tracker/CVE-2024-11614
- https://ubuntu.com/security/CVE-2024-11614
- https://git.dpdk.org/dpdk/commit/?id=ca7036b4af3a82d258cca914e71171434b3d0320
- https://git.dpdk.org/dpdk/commit/?id=4dc4e33ffa108e945fc8a1e2bbc7819791faa61e
- https://git.dpdk.org/dpdk-stable/commit/?id=fdf13ea6fede07538fbe5e2a46fa6d4b2368fa81
- https://git.dpdk.org/dpdk-stable/commit/?id=1570aef08bfde179449a9501bd54888a7d5f2cd6
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-11614
- agent/weakness
- agent/title
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/event
- agent/description
- collector/nvd-cve
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/author
- agent/references
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/debian