A flaw was found in dpdk, which allows a malicious primary vhost-user to attach an unexpected number of fds as ancillary data to VHOSTUSERGETINFLIGHTFD / VHOSTUSERSETINFLIGHTFD messages that are not closed by the secondary vhost-user. By sending such messages continuously, the primary vhost-user exhausts available fd in the vhost-user standby process, leading to a denial of service.

A vulnerability was found in DPDK through version 19.11, A malicious container which has direct access to the vhost-user socket can keep sending VHOSTUSERGETINFLIGHTFD messages which may cause leaking resources until resulting a DoS. Leaking resources being both file descriptors and virtual memory.

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function virtiodevrxbatchpacked().