Out-of-bounds Read in Red Hat Fast Datapath For Enterprise Linux 8
CVE-2024-11614
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (44.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000
Affected products
- Red Hat Fast Datapath For Enterprise Linux 8 — versions 0:3.1.0-159.el8fdp
- Red Hat Fast Datapath For Enterprise Linux 9 — versions 0:3.1.0-149.el9fdp, 0:3.3.0-92.el9fdp, 0:3.4.0-48.el9fdp
- Red Hat Fast Datapath For Rhel 7
- Red Hat Fast Datapath For Rhel 8
- Red Hat Fast Datapath For Rhel 9
- Red Hat Enterprise Linux 8 — versions 0:23.11-2.el8_10
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.8 Extended Update Support — versions 0:21.11-4.el8_8
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2025:0208 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0209 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0210 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0211 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0220 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0221 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:0222 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:3963 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:3964 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:3965 (vendor-advisory)
Frequently asked questions
- What is CVE-2024-11614?
- CVE-2024-11614 is a high-severity vulnerability in Red Hat Fast Datapath For Enterprise Linux 8, classified under Out-of-bounds Read. CVSS score: 7.4/10. Published 2024-12-18.
- How severe is CVE-2024-11614?
- High severity. CVSS v3 base score is 7.4 out of 10.