QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2019-14818

Back to search

CVE-2019-14818

Published: Nov 14, 2019

Modified: Aug 5, 2024

PUBLISHED

CVSS v3.0

7.5

HIGH

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

VendorProductVersions

DPDK

dpdk

affected
all dpdk version 17.x.x before 17.11.8
affected
all dpdk version 16.x.x before 16.11.10
affected
all dpdk version 18.x.x before 18.11.4
affected
all dpdk version 19.x.x before 19.08.1

Weaknesses (CWE)

CWE-401

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

FEDORA-2019-019df9a459
vendor-advisory
RHSA-2020:0166
vendor-advisory
RHSA-2020:0165
vendor-advisory
RHSA-2020:0168
vendor-advisory
RHSA-2020:0172
vendor-advisory
RHSA-2020:0171
vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now