Red Hat Enterprise Linux Fast Datapath vulnerabilities

5 CVEs affecting Red Hat Enterprise Linux Fast Datapath, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-2132, published 2022-08-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-14818, published 2019-11-14. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user…
CVE-2022-2132, published 2022-08-31. High severity, CVSS 8.6. EPSS: 2.2% chance of exploitation in the next 30 days. A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
CVE-2021-3905, published 2022-08-23. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
CVE-2021-3839, published 2022-08-23. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any…
CVE-2018-1059, published 2018-04-24. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses…