CVE-2022-0669
Medium
Description
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Dpdk Data Plane Development Kit
PublishedAug 29, 2022
First seenAug 29, 2022
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- dpdk data_plane_development_kit22.03 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dpdk data_plane_development_kit | 20.02 ≤ v < 22.03, 19.11, 22.03 | 22.03 |
| openvswitch openvswitch | 2.13.0, 2.15.0 | — |
| redhat openshift_container_platform | 4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.