Out-of-bounds Read in Red Hat Fast Datapath For Enterprise Linux 8
CVE-2024-11614
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
Vulnerability class: Buffer Overflow
EPSS: 0.006 (43.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
Affected products
- Red Hat Fast Datapath For Enterprise Linux 8 — versions 0:3.1.0-159.el8fdp
- Red Hat Fast Datapath For Enterprise Linux 9 — versions 0:3.1.0-149.el9fdp, 0:3.3.0-92.el9fdp, 0:3.4.0-48.el9fdp
- Red Hat Fast Datapath For Rhel 7
- Red Hat Fast Datapath For Rhel 8
- Red Hat Fast Datapath For Rhel 9
- Red Hat Enterprise Linux 8 — versions 0:23.11-2.el8_10
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.6 Update Services For Sap Solutions — versions 0:21.11-3.el8_6
- Red Hat Enterprise Linux 8.8 Extended Update Support — versions 0:21.11-4.el8_8
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2024-11614?
- CVE-2024-11614 is a high-severity vulnerability in Red Hat Fast Datapath For Enterprise Linux 8, classified under Out-of-bounds Read. CVSS score: 7.4/10. Published 2024-12-18.
- How severe is CVE-2024-11614?
- High severity. CVSS v3 base score is 7.4 out of 10.