CVE-2024-11614: Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csumstart offset.
Other sources
From DPDK v21.05, DPDK Vhost library checksum offload feature introduced a security vulnerability enabling an untrusted or compromised guest to crash hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads.
Affected versions are only vulnerable if the Vhost-based application registers devices with the RTEVHOSTUSERNETCOMPLIANTOLFLAGS flag.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11614?
CVE-2024-11614 is classified as a medium severity vulnerability due to its potential to crash the hypervisor's vSwitch.
How do I fix CVE-2024-11614?
To fix CVE-2024-11614, upgrade DPDK to a version that is not affected, such as 20.11.10-1~deb11u1 or newer.
Who is affected by CVE-2024-11614?
CVE-2024-11614 affects users of DPDK, specifically those using versions up to 22.11.6-1~deb12u1.
What can an attacker do with CVE-2024-11614?
An attacker can exploit CVE-2024-11614 to crash the hypervisor's vSwitch by forging Virtio descriptors.
Is there a workaround for CVE-2024-11614?
Currently, no specific workarounds are recommended other than upgrading the affected DPDK versions.