REDHAT-BUG-2529897: Medium severity DPDK nfp vDPA driver vulnerability
A flaw was found in the DPDK nfp vDPA driver. Vring, VFIO MSI-X, and epoll buffers are sized for NFPVDPAMAXQUEUES (one queue pair), but start and interrupt paths use unbounded rtevhostgetvringnum(). A guest or vhost-user frontend that presents more than two virtqueues can overflow stack and heap in the host vDPA backend.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this flaw?
Hosts using the DPDK nfp vDPA driver are exposed when a guest or vhost-user frontend can present more than two virtqueues to the host vDPA backend.
What does an attacker need to trigger the overflow?
An attacker needs control of, or the ability to influence, a guest or vhost-user frontend so that it reports more than two virtqueues. The affected start and interrupt paths use the reported virtqueue count without bounding it to the driver buffer capacity.
What can happen if the issue is triggered?
Presenting more than two virtqueues can overflow stack and heap buffers in the host vDPA backend. The affected buffers include vring, VFIO MSI-X, and epoll-related storage.