CVE-2020-10726 Denial of service in dpdk
A malicious container with vhost-user socket access can cause resource leaks leading to denial of service in DPDK.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10726?
CVE-2020-10726 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 20 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.
Weakness: CWE-190
Which versions are affected by CVE-2020-10726?
It affects 4 products.
Products include Dpdk Data Plane Development Kit, Fedoraproject Fedora, Opensuse Leap, Oracle Enterprise Communications Broker.
How do I fix CVE-2020-10726?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-10726 being exploited?
There is no known exploitation of CVE-2020-10726 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-10726, GHSA-whmr-hj5c-pm9g, UBUNTU-CVE-2020-10726.