A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhostcrypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected.

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying ivdata from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhostcrypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function virtiodevrxbatchpacked().

A flaw was found in the vhost library in DPDK. Function vhostusersetinflightfd() does not validate msg->payload.inflight.numqueues, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhostuser socket, can send specially crafted VRINGSETNUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.

From DPDK v21.05, DPDK Vhost library checksum offload feature introduced a security vulnerability enabling an untrusted or compromised guest to crash hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads.

Affected versions are only vulnerable if the Vhost-based application registers devices with the RTEVHOSTUSERNETCOMPLIANTOLFLAGS flag.

A vulnerability was found in DPDK through version 18.11, vhostusersetlogbase() is a message handler that is called to handle the VHOSTUSERSETLOGBASE message. Its payload contains a 64 bit size and offset. Both are added up and used as a size when calling mmap(). There is no integer overflow check. If an integer overflow occurs a smaller memory map would be created than requested. Since the returned mapping is mapped as writable and used for logging, it seems highly likely that memory corruption can occur.

A memory corruption issue was found in DPDK versions 17.05 and above

A flaw was found in dpdk, which allows a malicious primary vhost-user to attach an unexpected number of fds as ancillary data to VHOSTUSERGETINFLIGHTFD / VHOSTUSERSETINFLIGHTFD messages that are not closed by the secondary vhost-user. By sending such messages continuously, the primary vhost-user exhausts available fd in the vhost-user standby process, leading to a denial of service.

Last updated 18 August 2025

A vulnerability was found in DPDK through version 19.11, A malicious container which has direct access to the vhost-user socket can keep sending VHOSTUSERGETINFLIGHTFD messages which may cause leaking resources until resulting a DoS. Leaking resources being both file descriptors and virtual memory.

A vulnerability was found in DPDK through version 18.11, The vhost crypto library code contains a post message handler (vhostcryptomsgposthandler) which calls vhostcryptocreatesess() which in turn calls transformcipherparam() depending on the operation type. It is transformcipherparam() that handles the payload data. The payload contains a cipher key length and a static VHOSTUSERCRYPTOMAXCIPHERKEYLENGTH (64) byte key buffer. When transformcipherparam() handles the payload data it does not check to see if the buffer length doesn't exceed VHOSTUSERCRYPTOMAXCIPHERKEYLENGTH. This missing check can cause out of bound reads which could trigger a crash or a potential information leak. Also, the vhost crypto library code contains a post message handler (vhostcryptomsgposthandler) which calls vhostcryptocreatesess() which in turn calls transformchainparam() depending on the operation type. It is transformchainparam() that handles the payload data. The payload contains a cipher key length and a static VHOSTUSERCRYPTOMAXCIPHERKEYLENGTH (64) byte key buffer, it also contains a digest length and a static authentication key buffer (size: VHOSTUSERCRYPTOMAXHMACKEYLENGTH(512)) and authentication key buffer length. None of these length values are validated. Which can lead to reading out of bound.

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the movedesc function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause movedesc to get stuck in a 4,294,967,295-count iteration loop. Depending on how vhostcrypto is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

A vulnerability was fixed in DPDK.

Some downstream stakeholders were warned in advance through security-prerelease () dpdk org in order to coordinate the release of fixes and reduce the vulnerability window [0].

A malicious guest using a virtio driver can cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csumstart offset.

Commits per branch: LTS Releases: 24.11 - https://fast.dpdk.org/rel/dpdk-24.11.1.tar.xz 23.11 - https://fast.dpdk.org/rel/dpdk-23.11.3.tar.xz 22.11 - https://fast.dpdk.org/rel/dpdk-22.11.7.tar.xz 21.11 - https://fast.dpdk.org/rel/dpdk-21.11.9.tar.xz

CVE: CVE-2024-11614 Severity: 7.2 CVSS scores: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:F/RC:C

[0]: https://mails.dpdk.org/listinfo/security-prerelease