CVEvulnerability
CVE-2022-0669
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-08-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
Affected configurations
• dpdk data plane development kit (>= 20.02 < 22.03)
• dpdk data plane development kit 19.11
• dpdk data plane development kit 22.03
• openvswitch openvswitch 2.13.0
• openvswitch openvswitch 2.15.0
• redhat openshift container platform 4.0
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://access.redhat.com/security/cve/CVE-2022-0669 Third Party Advisory
- https://bugs.dpdk.org/show_bug.cgi?id=922 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2055793 Issue Tracking, Patch, Third Party Advisory
- https://github.com/DPDK/dpdk/commit/af74f7db384ed149fe42b21dbd7975f8a54ef227 Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-0669 Patch, Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-0669 Third Party Advisory
- https://bugs.dpdk.org/show_bug.cgi?id=922 Patch, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2055793 Issue Tracking, Patch, Third Party Advisory
- https://github.com/DPDK/dpdk/commit/af74f7db384ed149fe42b21dbd7975f8a54ef227 Patch, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-0669 Patch, Third Party Advisory