CVE-2020-10722: A vulnerability was found in DPDK versions 18.05 and above

Medium severity · published May 19, 2020

CVE-2020-10722

A vulnerability was found in DPDK versions 18.05 and above

6.7

CVSS

0.4%

EPSS

On KEV

Description

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 32% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Communications Session Border Controller · Oracle

8.2 through 8.4 · source: NVD

Data Plane Development Kit · Dpdk

through 18.05 · source: NVD

Enterprise Communications Broker · Oracle

3.1.0; 3.2.0 · source: NVD

Fedora · Fedoraproject

32 · source: NVD

Leap · Opensuse

15.1 · source: NVD

Ubuntu Linux · Canonical

18.04; 19.10; 20.04 · source: NVD

Affected product

Ubuntu Linux

Canonical

All Ubuntu Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-10722

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-10722

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html

Issue Tracking

https://bugs.dpdk.org/show_bug.cgi?id=267

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10722

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/

Third Party Advisory

https://usn.ubuntu.com/4362-1/

Mailing List

https://www.openwall.com/lists/oss-security/2020/05/18/2