CVE-2020-14374

NameCVE-2020-14374
DescriptionA flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs971269

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dpdk (PTS)bullseye20.11.10-1~deb11u1fixed
bullseye (security)20.11.6-1~deb11u1fixed
bookworm22.11.5-1~deb12u1fixed
sid, trixie23.11.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dpdksourcestretch(not affected)
dpdksourcebuster18.11.10-1~deb10u1
dpdksource(unstable)19.11.5-1971269

Notes

[stretch] - dpdk <not-affected> (vhost_crypto introduced in v18.05-rc1)
https://bugs.dpdk.org/show_bug.cgi?id=272
https://git.dpdk.org/dpdk-stable/commit/?id=75f8df70a2c8a477ed61bf3145746ef1164466ce (v18.11.10)
Introduced by: https://git.dpdk.org/dpdk-stable/commit/?id=3c79609fda7cba51835c5f76e1bf4a454c653ff2 (v18.05-rc5)

Search for package or bug name: Reporting problems