1. CVE-Search
  2. CVE-2019-14818
ID CVE-2019-14818
Summary A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
References
Vulnerable Configurations
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.04:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.04:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.07:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.07:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.07.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.07.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.07.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.07.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.4:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.4:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.5:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.5:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.6:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.6:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.7:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.7:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.8:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.8:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:16.11.9:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:16.11.9:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.02:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.02:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.02.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.02.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.05:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.05:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.05.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.05.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.05.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.05.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.08:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.08:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.08.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.08.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.08.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.08.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.4:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.4:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.5:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.5:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.6:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.6:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:17.11.7:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:17.11.7:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.02:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.02:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.02.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.02.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.02.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.02.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.05:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.05:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.08:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.08:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.08.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.08.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.11:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.11:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.11.1:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.11.2:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.11.2:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:18.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:18.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.02:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:19.02:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.05:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:19.05:*:*:*:*:*:*:*
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.08:*:*:*:*:*:*:*
    cpe:2.3:a:dpdk:data_plane_development_kit:19.08:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:virtualization_eus:4.2:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:virtualization_eus:4.2:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 07-11-2022 - 19:45)
Impact:
Exploitability:
CWE CWE-401
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • bugzilla
    id 1805140
    title Remove mlx{4,5} glue library
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 8 is installed
        oval oval:com.redhat.rhba:tst:20193384074
      • OR
        • AND
          • comment dpdk is earlier than 0:19.11-4.el8
            oval oval:com.redhat.rhsa:tst:20201735001
          • comment dpdk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20201735002
        • AND
          • comment dpdk-debugsource is earlier than 0:19.11-4.el8
            oval oval:com.redhat.rhsa:tst:20201735003
          • comment dpdk-debugsource is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20201735004
        • AND
          • comment dpdk-devel is earlier than 0:19.11-4.el8
            oval oval:com.redhat.rhsa:tst:20201735005
          • comment dpdk-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20201735006
        • AND
          • comment dpdk-doc is earlier than 0:19.11-4.el8
            oval oval:com.redhat.rhsa:tst:20201735007
          • comment dpdk-doc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20201735008
        • AND
          • comment dpdk-tools is earlier than 0:19.11-4.el8
            oval oval:com.redhat.rhsa:tst:20201735009
          • comment dpdk-tools is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20201735010
    rhsa
    id RHSA-2020:1735
    released 2020-04-28
    severity Moderate
    title RHSA-2020:1735: dpdk security, bug fix, and enhancement update (Moderate)
  • rhsa
    id RHSA-2020:0165
  • rhsa
    id RHSA-2020:0166
  • rhsa
    id RHSA-2020:0168
  • rhsa
    id RHSA-2020:0171
  • rhsa
    id RHSA-2020:0172
rpms
  • openvswitch-0:2.9.0-124.el7fdp
  • openvswitch-debuginfo-0:2.9.0-124.el7fdp
  • openvswitch-devel-0:2.9.0-124.el7fdp
  • openvswitch-ovn-central-0:2.9.0-124.el7fdp
  • openvswitch-ovn-common-0:2.9.0-124.el7fdp
  • openvswitch-ovn-host-0:2.9.0-124.el7fdp
  • openvswitch-ovn-vtep-0:2.9.0-124.el7fdp
  • openvswitch-test-0:2.9.0-124.el7fdp
  • python-openvswitch-0:2.9.0-124.el7fdp
  • openvswitch2.11-0:2.11.0-35.el7fdp
  • openvswitch2.11-debuginfo-0:2.11.0-35.el7fdp
  • openvswitch2.11-devel-0:2.11.0-35.el7fdp
  • openvswitch2.11-test-0:2.11.0-35.el7fdp
  • python-openvswitch2.11-0:2.11.0-35.el7fdp
  • openvswitch2.12-0:2.12.0-12.el7fdp
  • openvswitch2.12-debuginfo-0:2.12.0-12.el7fdp
  • openvswitch2.12-devel-0:2.12.0-12.el7fdp
  • openvswitch2.12-test-0:2.12.0-12.el7fdp
  • python-openvswitch2.12-0:2.12.0-12.el7fdp
  • network-scripts-openvswitch2.11-0:2.11.0-35.el8fdp
  • openvswitch2.11-0:2.11.0-35.el8fdp
  • openvswitch2.11-debuginfo-0:2.11.0-35.el8fdp
  • openvswitch2.11-debugsource-0:2.11.0-35.el8fdp
  • openvswitch2.11-devel-0:2.11.0-35.el8fdp
  • openvswitch2.11-test-0:2.11.0-35.el8fdp
  • python3-openvswitch2.11-0:2.11.0-35.el8fdp
  • python3-openvswitch2.11-debuginfo-0:2.11.0-35.el8fdp
  • network-scripts-openvswitch2.12-0:2.12.0-12.el8fdp
  • openvswitch2.12-0:2.12.0-12.el8fdp
  • openvswitch2.12-debuginfo-0:2.12.0-12.el8fdp
  • openvswitch2.12-debugsource-0:2.12.0-12.el8fdp
  • openvswitch2.12-devel-0:2.12.0-12.el8fdp
  • openvswitch2.12-test-0:2.12.0-12.el8fdp
  • python3-openvswitch2.12-0:2.12.0-12.el8fdp
  • python3-openvswitch2.12-debuginfo-0:2.12.0-12.el8fdp
  • dpdk-0:18.11.5-1.el7_8
  • dpdk-debuginfo-0:18.11.5-1.el7_8
  • dpdk-devel-0:18.11.5-1.el7_8
  • dpdk-doc-0:18.11.5-1.el7_8
  • dpdk-tools-0:18.11.5-1.el7_8
  • dpdk-0:19.11-4.el8
  • dpdk-debuginfo-0:19.11-4.el8
  • dpdk-debugsource-0:19.11-4.el8
  • dpdk-devel-0:19.11-4.el8
  • dpdk-devel-debuginfo-0:19.11-4.el8
  • dpdk-doc-0:19.11-4.el8
  • dpdk-tools-0:19.11-4.el8
refmap via4
confirm https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
fedora FEDORA-2019-019df9a459
misc https://bugs.dpdk.org/show_bug.cgi?id=363
Last major update 07-11-2022 - 19:45
Published 14-11-2019 - 17:15
Last modified 07-11-2022 - 19:45
Back to Top