CVE-2019-14818: dpdk data_plane_development_kit

CVSS: 7.5v3.0HighModified

AliasesSUSE-SU-2019:3032-1SUSE-SU-2019:3179-1SUSE-SU-2020:0412-1+13 more

Published 14-11-2019Last modified 05-08-2024

Vulnerability summary

CVE-2019-14818 is a high (CVSS 7.5) vulnerability in dpdk data_plane_development_kit. EPSS estimates a 2.81% chance of exploitation in the next 30 days, higher than 86.3% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.0 (CVE.org)

EPSS score

2.81%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3

OPENSUSE-SU-2024:10727-1 SUSE-SU-2020:1430-1 SUSE-SU-2020:2194-1

Timeline

14-11-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

CVSS metrics

8 scores · 5 sources · 3 versions

v3.17.5v3.07.5v2.05.0

EPSS trend

Probability

2.81%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.81% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.81%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Redhat77 products

enterprise_linux_fast_datapath7.0 | 8.0
openstack10
virtualization_eus4.2
ansible-role-redhat-subscription< 0:1.0.4-2.el7ost
dpdk< 0:18.11.5-1.el7_8 | < 0:19.11-4.el8

dpdk-debuginfo< 0:18.11.5-1.el7_8 | < 0:19.11-4.el8
dpdk-debugsource< 0:19.11-4.el8
dpdk-devel< 0:18.11.5-1.el7_8 | < 0:19.11-4.el8
dpdk-devel-debuginfo< 0:19.11-4.el8
dpdk-doc< 0:18.11.5-1.el7_8 | < 0:19.11-4.el8
dpdk-tools< 0:18.11.5-1.el7_8 | < 0:19.11-4.el8
network-scripts-openvswitch2.11< 0:2.11.0-35.el8fdp
network-scripts-openvswitch2.12< 0:2.12.0-12.el8fdp
openstack-manila< 1:6.3.2-1.el7ost
openstack-manila-share< 1:6.3.2-1.el7ost
openstack-octavia-ui< 0:1.0.2-1.el7ost
openstack-tempest< 1:18.0.0-13.el7ost
openstack-tempest-all< 1:18.0.0-13.el7ost
openvswitch< 0:2.9.0-124.el7fdp
openvswitch-debuginfo< 0:2.9.0-124.el7fdp
openvswitch-devel< 0:2.9.0-124.el7fdp
openvswitch-ovn-central< 0:2.9.0-124.el7fdp
openvswitch-ovn-common< 0:2.9.0-124.el7fdp
openvswitch-ovn-host< 0:2.9.0-124.el7fdp
openvswitch-ovn-vtep< 0:2.9.0-124.el7fdp
openvswitch-test< 0:2.9.0-124.el7fdp
openvswitch2.11< 0:2.11.0-35.el7fdp | < 0:2.11.0-35.el8fdp
openvswitch2.11-debuginfo< 0:2.11.0-35.el7fdp | < 0:2.11.0-35.el8fdp
openvswitch2.11-debugsource< 0:2.11.0-35.el8fdp
openvswitch2.11-devel< 0:2.11.0-35.el7fdp | < 0:2.11.0-35.el8fdp
openvswitch2.11-test< 0:2.11.0-35.el7fdp | < 0:2.11.0-35.el8fdp
openvswitch2.12< 0:2.12.0-12.el7fdp | < 0:2.12.0-12.el8fdp
openvswitch2.12-debuginfo< 0:2.12.0-12.el7fdp | < 0:2.12.0-12.el8fdp
openvswitch2.12-debugsource< 0:2.12.0-12.el8fdp
openvswitch2.12-devel< 0:2.12.0-12.el7fdp | < 0:2.12.0-12.el8fdp
openvswitch2.12-test< 0:2.12.0-12.el7fdp | < 0:2.12.0-12.el8fdp
python-barbican-tests-tempest< 0:0.1.0-0.20180828144800.b8bf147.el7ost
python-hardware< 0:0.23.0-0.20200117070144.59211cc.el7ost
python-hardware-detect< 0:0.23.0-0.20200117070144.59211cc.el7ost
python-keystoneauth1< 0:3.4.1-2.el7ost
python-keystonemiddleware< 0:4.22.0-1.el7ost
python-manila< 1:6.3.2-1.el7ost
python-manila-tests< 1:6.3.2-1.el7ost
python-neutron-lib< 0:1.13.0-2.el7ost
python-novajoin< 0:1.3.0-1.el7ost
python-octavia-tests-tempest< 0:1.1.0-1.el7ost
python-octavia-tests-tempest-debuginfo< 0:1.1.0-1.el7ost
python-octavia-tests-tempest-golang< 0:1.1.0-1.el7ost
python-openstackclient< 0:3.14.3-5.el7ost
python-openstackclient-lang< 0:3.14.3-5.el7ost
python-openstacksdk< 0:0.11.4-1.el7ost
python-openvswitch< 0:2.9.0-124.el7fdp
python-openvswitch2.11< 0:2.11.0-35.el7fdp
python-openvswitch2.12< 0:2.12.0-12.el7fdp
python-os-testr< 0:1.0.1-0.20200218144109.7dd678e.el7ost
python-os-vif< 0:1.9.2-1.el7ost
python-ovsdbapp< 0:0.10.4-2.el7ost
python-tempestconf< 0:2.4.0-1.el7ost
python2-barbican-tests-tempest< 0:0.1.0-0.20180828144800.b8bf147.el7ost
python2-keystoneauth1< 0:3.4.1-2.el7ost
python2-keystonemiddleware< 0:4.22.0-1.el7ost
python2-neutron-lib< 0:1.13.0-2.el7ost
python2-neutron-lib-tests< 0:1.13.0-2.el7ost
python2-octavia-tests-tempest< 0:1.1.0-1.el7ost
python2-openstackclient< 0:3.14.3-5.el7ost
python2-openstacksdk< 0:0.11.4-1.el7ost
python2-os-vif< 0:1.9.2-1.el7ost
python2-ovsdbapp< 0:0.10.4-2.el7ost
python2-tempest< 1:18.0.0-13.el7ost
python2-tempest-tests< 1:18.0.0-13.el7ost
python2-tempestconf< 0:2.4.0-1.el7ost
python3-openvswitch2.11< 0:2.11.0-35.el8fdp
python3-openvswitch2.11-debuginfo< 0:2.11.0-35.el8fdp
python3-openvswitch2.12< 0:2.12.0-12.el8fdp
python3-openvswitch2.12-debuginfo< 0:2.12.0-12.el8fdp
rabbitmq-server< 0:3.6.15-6.el7ost
rhosp-release< 0:13.0.11-1.el7ost

Show all 77

Suse15 products

dpdk-thunderx&distro=SUSE Linux Enterprise Module for Server Applications 15< 18.11.3-3.16.1
dpdk-thunderx&distro=SUSE Linux Enterprise Server 12 SP4< 17.11.7-5.3.2
dpdk-thunderx&distro=SUSE Linux Enterprise Server 12 SP5< 18.11.3-3.6.1
dpdk-thunderx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 17.11.7-5.3.2
dpdk-thunderx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 18.11.3-3.6.1

Show all 15

Dpdk2 products

data_plane_development_kit≥ 16.04, < 16.11.10 | ≥ 17.02, < 17.11.8 | ≥ 18.02, < 18.11.4 | ≥ 19.02, < 19.08.1
dpdkall dpdk version 17.x.x before 17.11.8 | all dpdk version 16.x.x before 16.11.10 | all dpdk version 18.x.x before 18.11.4 | all dpdk version 19.x.x before 19.08.1

Debian1 product

dpdk< 18.11.4-1 | < 16.11.9-1+deb9u2 | < 18.11.2-2+deb10u2

Fedoraproject1 product

fedoraEOL31

Ubuntu1 product

dpdkAll versions (No fix recorded) | < 17.11.8-0~ubuntu18.04.2

6 vendors · 97 products

References

97 links

lists.fedoraproject.org/archives/…Vendor Advisory
access.redhat.com/errata/RHSA-2020:0166Vendor AdvisoryThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2020:0165Vendor AdvisoryThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2020:0168Vendor AdvisoryThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2020:0172Vendor AdvisoryThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2020:0171Vendor AdvisoryThird Party AdvisoryAdvisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818Issue TrackingPatchThird Party Advisory
bugs.dpdk.org/show_bug.cgi?id=363Issue TrackingPatchVendor AdvisoryARTICLE
www.suse.com/support/update/announcement/2019/suse-su-20193032-1/Advisory
bugzilla.suse.com/1156146REPORT

Show all 97 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities