CVE-2020-10725: dpdk data_plane_development_kit Improper Initialization
Vulnerability summary
CVE-2020-10725 is a high (CVSS 7.7) Improper Initialization vulnerability in dpdk data_plane_development_kit. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 20-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- NVDNIST7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- dpdk< 0:19.11-5.el8_2
- dpdk-debuginfo< 0:19.11-5.el8_2
- dpdk-debugsource< 0:19.11-5.el8_2
- dpdk-devel< 0:19.11-5.el8_2
- dpdk-devel-debuginfo< 0:19.11-5.el8_2
[unknown]1 product
- dpdk20.02.1 | 19.11.2
Debian1 product
- dpdk< 19.11.2-1
Dpdk1 product
- data_plane_development_kit≤ 19.11
Fedoraproject1 product
- fedoraEOL32
Opensuse1 product
- leapEOL15.1
Oracle1 product
- enterprise_communications_broker3.1.0 | 3.2.0
Ubuntu1 product
- dpdk< 19.11.1-0ubuntu1.1
8 vendors · 14 products
References
16 links- lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2020/05/18/2X Refsource MISCARTICLEMailing ListThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725X Refsource CONFIRMIssue TrackingThird Party Advisory
