CVE-2020-10726

Name	CVE-2020-10726
Description	A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	960936

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dpdk (PTS)	bullseye	20.11.10-1~deb11u1	fixed
	bullseye (security)	20.11.6-1~deb11u1	fixed
	bookworm	22.11.9-1~deb12u1	fixed
	bookworm (security)	22.11.7-1~deb12u1	fixed
	trixie	24.11.3-1~deb13u1	fixed
	forky, sid	24.11.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
dpdk	source	stretch	(not affected)
dpdk	source	buster	(not affected)
dpdk	source	(unstable)	19.11.2-1	960936

[buster] - dpdk <not-affected> (Vulnerable code not present)
[stretch] - dpdk <not-affected> (Vulnerable code not present)