REDHAT-BUG-2327955: High severity DPDK DPDK vulnerability
From DPDK v21.05, DPDK Vhost library checksum offload feature introduced a security vulnerability enabling an untrusted or compromised guest to crash hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads.
Affected versions are only vulnerable if the Vhost-based application registers devices with the RTEVHOSTUSERNETCOMPLIANTOLFLAGS flag.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2327955?
The severity of REDHAT-BUG-2327955 is critical due to the potential for untrusted guests to crash the hypervisor's vSwitch.
How do I fix REDHAT-BUG-2327955?
To fix REDHAT-BUG-2327955, it is recommended to upgrade to a patched version of DPDK that addresses this vulnerability.
Which versions are affected by REDHAT-BUG-2327955?
DPDK versions starting from 21.05 are affected by REDHAT-BUG-2327955 if used with Vhost-based applications.
What is the impact of exploiting REDHAT-BUG-2327955?
Exploiting REDHAT-BUG-2327955 could result in out-of-bounds reads that crash the hypervisor's vSwitch, affecting availability.
Is there a workaround for REDHAT-BUG-2327955?
Currently, the most effective workaround for REDHAT-BUG-2327955 is to avoid using vulnerable Vhost-based applications until an upgrade is completed.