CVE-2019-14818

NameCVE-2019-14818
DescriptionA flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4567-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dpdk (PTS)stretch16.11.9-1+deb9u1vulnerable
stretch (security)16.11.9-1+deb9u2fixed
buster18.11.2-2+deb10u1vulnerable
buster (security)18.11.2-2+deb10u2fixed
bullseye, sid18.11.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dpdksource(unstable)18.11.4-1
dpdksourcebuster18.11.2-2+deb10u2DSA-4567-1
dpdksourcestretch16.11.9-1+deb9u2DSA-4567-1

Notes

http://mails.dpdk.org/archives/announce/2019-November/000293.html
https://bugs.dpdk.org/show_bug.cgi?id=363

Search for package or bug name: Reporting problems