[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ee1c083f-733a-181a-8a64-d5fe4fbe4d76@intel.com>
Date: Tue, 12 Nov 2019 15:04:34 +0000
From: Ferruh Yigit <ferruh.yigit@...el.com>
To: dpdk-announce <announce@...k.org>
Cc: security@...k.org, security-prerelease@...k.org,
oss-security@...ts.openwall.com
Subject: DPDK security advisory: CVE-2019-14818
A vulnerability was fixed in DPDK.
Some downstream stakeholders were warned in advance in order to coordinate the
release of fixes and reduce the vulnerability window.
Problem:
A malicious container which has direct access to the vhost-user socket can keep
sending messages which may cause leaking resources until resulting a DOS.
All users of the vhost library are strongly encouraged to upgrade as soon as
possible.
CVE-2019-14818
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=363
Severity: Medium
CVSS scores: 6.8
Commits:
main repo
https://git.dpdk.org/dpdk/commit/?id=612e17cf6d7b
https://git.dpdk.org/dpdk/commit/?id=bf472259dde6
19.08.1
https://git.dpdk.org/dpdk-stable/commit/?h=19.08&id=fa674d08985f
https://git.dpdk.org/dpdk-stable/commit/?h=19.08&id=6547dd563ea9
18.11.4 (LTS)
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=70583a6b9b1c
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=f8898927bb16
17.11.8 (LTS)
https://git.dpdk.org/dpdk-stable/commit/?h=17.11&id=3b1b44a1c82a
https://git.dpdk.org/dpdk-stable/commit/?h=17.11&id=8a8dbd0ec19e
https://git.dpdk.org/dpdk-stable/commit/?h=17.11&id=1f6147d9a01f
16.11.10 (LTS EOL)
https://git.dpdk.org/dpdk-stable/commit/?h=16.11&id=5fbb5c2919b6
https://git.dpdk.org/dpdk-stable/commit/?h=16.11&id=3863340f93b8
https://git.dpdk.org/dpdk-stable/commit/?h=16.11&id=8790f4c3bcd2
https://git.dpdk.org/dpdk-stable/commit/?h=16.11&id=1bf11cfb7c7c
Stable Releases download links:
DPDK 19.08.1
http://fast.dpdk.org/rel/dpdk-19.08.1.tar.xz
DPDK 18.11.4 (LTS)
http://fast.dpdk.org/rel/dpdk-18.11.4.tar.xz
DPDK 17.11.8 (LTS)
http://fast.dpdk.org/rel/dpdk-17.11.8.tar.xz
DPDK 16.11.10 (LTS EOL)
http://fast.dpdk.org/rel/dpdk-16.11.10.tar.xz
--
DPDK Security Team
http://core.dpdk.org/security/
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
