The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• canonical ubuntu linux17.10
• canonical ubuntu linux18.04
• dpdk data plane development kitbefore 18.02.1
• redhat ceph storage3.0
• redhat enterprise linux7.0
• redhat enterprise linux fast datapath7.0
• redhat openshift3.0
• redhat openstack10
• redhat openstack11
• redhat openstack12
• redhat openstack8
• redhat openstack9
• redhat virtualization4.0
• redhat virtualization4.1
• redhat virtualization manager4.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat, Inc. DPDK

  • before 18.02.1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-2132A permissive list of allowed inputs flaw was found in DPDK.
  35Monitor
• CVE-2020-14374A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.
  35Monitor
• CVE-2020-14376A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.
  31Monitor
• CVE-2020-14375A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.
  31Monitor
• CVE-2020-10725A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend appli
  31Monitor
• CVE-2019-14818A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.