CVE-2020-10725 Null dereference in dpdk

High 7.7 Published 20 May 2020 Updated 4 Aug 2024

A malicious guest can crash the host's vhost-user backend via a missing descriptor check, causing denial of service for other guests.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-10725?

CVE-2020-10725 is a high-severity vulnerability in Fedoraproject Fedora, published on 20 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Weakness: CWE-665

Which versions are affected by CVE-2020-10725?

It affects 4 products.

Linux distribution packages (7)

`dpdk` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-debugsource` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-devel` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-devel-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-doc` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`
`dpdk-tools` Red Hat:rhel_eus:8.2::appstream	All versions	`0:19.11-5.el8_2`

Products include Dpdk Data Plane Development Kit, Fedoraproject Fedora, Opensuse Leap, Oracle Enterprise Communications Broker.

How do I fix CVE-2020-10725?

Apply the vendor's patch.

Is CVE-2020-10725 being exploited?

There is no known exploitation of CVE-2020-10725 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-10725, GHSA-rccg-5mcc-m2cf, RHSA-2021:1239, UBUNTU-CVE-2020-10725.