CVE-2020-14378

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 22%
VendorProductVersion
dpdkdata_plane_development_kit
18.02.1 ≤
𝑥
< 18.11.10
dpdkdata_plane_development_kit
19.02 ≤
𝑥
< 19.11.5
canonicalubuntu_linux
20.04
opensuseleap
15.1
opensuseleap
15.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dpdk
bullseye
20.11.10-1~deb11u1
fixed
stretch
not-affected
bullseye (security)
20.11.6-1~deb11u1
fixed
bookworm
22.11.5-1~deb12u1
fixed
sid
23.11.2-2
fixed
trixie
23.11.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dpdk
focal
Fixed 19.11.3-0ubuntu0.2
released
bionic
not-affected
xenial
not-affected
trusty
dne