REDHAT-BUG-2327955
First published: Fri Nov 22 2024(Updated: )
From DPDK v21.05, DPDK Vhost library checksum offload feature introduced a security vulnerability enabling an untrusted or compromised guest to crash hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. Affected versions are only vulnerable if the Vhost-based application registers devices with the RTE_VHOST_USER_NET_COMPLIANT_OL_FLAGS flag.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| DPDK (Data Plane Development Kit) | >=21.05 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:0211
- https://access.redhat.com/errata/RHSA-2025:0210
- https://access.redhat.com/errata/RHSA-2025:0208
- https://access.redhat.com/errata/RHSA-2025:0209
- https://access.redhat.com/errata/RHSA-2025:0221
- https://access.redhat.com/errata/RHSA-2025:0220
- https://access.redhat.com/errata/RHSA-2025:0222
- https://bugzilla.redhat.com/show_bug.cgi?id=2327955
Frequently Asked Questions
What is the severity of REDHAT-BUG-2327955?
The severity of REDHAT-BUG-2327955 is critical due to the potential for untrusted guests to crash the hypervisor's vSwitch.
How do I fix REDHAT-BUG-2327955?
To fix REDHAT-BUG-2327955, it is recommended to upgrade to a patched version of DPDK that addresses this vulnerability.
Which versions are affected by REDHAT-BUG-2327955?
DPDK versions starting from 21.05 are affected by REDHAT-BUG-2327955 if used with Vhost-based applications.
What is the impact of exploiting REDHAT-BUG-2327955?
Exploiting REDHAT-BUG-2327955 could result in out-of-bounds reads that crash the hypervisor's vSwitch, affecting availability.
Is there a workaround for REDHAT-BUG-2327955?
Currently, the most effective workaround for REDHAT-BUG-2327955 is to avoid using vulnerable Vhost-based applications until an upgrade is completed.
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-11614
- agent/last-modified-date
- agent/references
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/dpdk
- canonical/dpdk (data plane development kit)