CVE-2019-14818

Name	CVE-2019-14818
Description	A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4567-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dpdk (PTS)	bullseye	20.11.10-1~deb11u1	fixed
	bullseye (security)	20.11.6-1~deb11u1	fixed
	bookworm	22.11.9-1~deb12u1	fixed
	bookworm (security)	22.11.7-1~deb12u1	fixed
	trixie	24.11.3-1~deb13u1	fixed
	forky, sid	24.11.3-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
dpdk	source	stretch	16.11.9-1+deb9u2	DSA-4567-1
dpdk	source	buster	18.11.2-2+deb10u2	DSA-4567-1
dpdk	source	(unstable)	18.11.4-1

http://mails.dpdk.org/archives/announce/2019-November/000293.html
https://bugs.dpdk.org/show_bug.cgi?id=363