A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2021-3839 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2025882 | Issue Tracking Patch Third Party Advisory |
| https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
26 Aug 2022, 19:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-125 CWE-787 |
|
| First Time |
Fedoraproject
Dpdk Redhat enterprise Linux Fast Datapath Fedoraproject fedora Redhat Redhat enterprise Linux Dpdk data Plane Development Kit |
|
| CPE | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:* cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc2:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc3:*:*:*:*:*:* cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc1:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
|
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2025882 - Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5 - Patch, Third Party Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2021-3839 - Third Party Advisory |
23 Aug 2022, 17:04
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-23 16:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-3839
Mitre link : CVE-2021-3839
CVE.ORG link : CVE-2021-3839
JSON object : View
Products Affected
redhat
- enterprise_linux_fast_datapath
- enterprise_linux
dpdk
- data_plane_development_kit
fedoraproject
- fedora