Summary
The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.
Security Fix(es):
* dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)
* DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash (CVE-2021-3839)
* dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service (CVE-2022-28199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | dpdk | 2:21.11.2-1.el9_1 |
| AlmaLinux · 9 | dpdk-devel | 2:21.11.2-1.el9_1 |
| AlmaLinux · 9 | dpdk-doc | 2:21.11.2-1.el9_1 |
| AlmaLinux · 9 | dpdk-tools | 2:21.11.2-1.el9_1 |
Vulnerabilities 3
-
Medium 6.5
NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, wher…
-
Unscored —
A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.in…
-
Unscored —
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of se…
References
-
report
https://access.redhat.com/security/cve/CVE-2021-3839
-
report
https://access.redhat.com/security/cve/CVE-2022-2132
-
report
https://access.redhat.com/security/cve/CVE-2022-28199
-
report
https://bugzilla.redhat.com/2025882
-
report
https://bugzilla.redhat.com/2099475
-
report
https://bugzilla.redhat.com/2123549
-
advisory
https://errata.almalinux.org/9/ALSA-2022-8263.html