REDHAT-BUG-2529853: High severity DPDK lib/vhost vhost-crypto vulnerability
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot still double-fetches srcdesc->next: it checks the index, then indexes the live guest table with a second read. A guest can change next after the check and force an out-of-bounds access. This is a remaining TOCTOU after CVE-2020-14375, not that ID.
Affected Software
Event History
Frequently Asked Questions
What attacker capability is required to trigger this flaw?
An attacker needs control of a guest that can modify the indirect descriptor table. They can change src_desc->next after its index is checked but before the live guest table is read again.
What component must be in use to be exposed?
The affected component is DPDK lib/vhost vhost-crypto. The issue concerns its handling of indirect descriptors.
Is this the same issue as CVE-2020-14375?
No. This is described as a remaining time-of-check to time-of-use condition after CVE-2020-14375, rather than CVE-2020-14375 itself.