CVE-2021-3839 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-3839 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

EPSS 0.47% · 64.6th percentile

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.47%

64.6th percentile

Affected Products

Vendor	Product	Versions
redhat	enterprise_linux_fast_datapath	8.0, 7.0
redhat	enterprise_linux	7.0, 9.0, 8.0
n/a	dpdk	Fixed in dpdk v22.03
dpdk	data_plane_development_kit	22.03, 22.03, 22.03
fedoraproject	fedora	35

Timeline

Aug 23, 2022 CVE Published
Aug 24, 2022 EPSS Score
Oct 8, 2022 EPSS Score
Nov 22, 2022 EPSS Score
Jan 6, 2023 EPSS Score
Feb 20, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 7, 2023 EPSS Score
May 22, 2023 EPSS Score
Jul 6, 2023 EPSS Score
Aug 20, 2023 EPSS Score
Oct 4, 2023 EPSS Score

References

Open in Interactive Console →