REDHAT-BUG-2529684: Medium severity DPDK lib/vhost vulnerability
A flaw was found in DPDK lib/vhost. Runt RX descriptors underflow the copy length in vhost enqueue on both split and packed rings. Unsigned subtraction underflow allows a full packet copy past a tiny descriptor window, which can crash a host vswitch such as OVS-DPDK.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this flaw?
Deployments using DPDK lib/vhost with a host virtual switch such as OVS-DPDK are exposed to the described crash condition. The issue affects vhost enqueue processing on both split and packed rings.
What input condition is needed to trigger the issue?
The condition involves runt RX descriptors that cause the copy-length calculation in vhost enqueue to underflow. The unsigned subtraction can then result in copying a full packet beyond a very small descriptor window.
What is the likely impact if the flaw is triggered?
A full packet copy past the descriptor window can crash the host virtual switch, including an OVS-DPDK instance.