Memory Corruption Vulnerability in DPDK Package: CVE-2020-10723
Summary
UBUNTU-CVE-2020-10723: A memory corruption issue was found in DPDK versions 17.05 and above. Affects dpdk versions < 17.11.9-0ubuntu18.04.2. Fixed in 17.11.9-0ubuntu18.04.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DPDK (Data Plane Development Kit) is a set of libraries and drivers for fast packet processing. It is widely used in networking applications to enhance performance and efficiency. The package is designed to run on various hardware platforms and supports multiple architectures. However, certain versions of DPDK have been found to be vulnerable to memory corruption issues, specifically versions 17.05 and above.
Vulnerability Detail
A memory corruption issue was identified in DPDK versions 17.05 and above. This vulnerability arises from an integer truncation on the index of a payload. Under specific conditions, the index, which is a UInt, is copied and truncated into a uint16, leading to potential out-of-bounds indexing. This can result in memory corruption, which may allow an attacker to exploit the system, potentially leading to unauthorized access or system crashes.
How To Fix
Minimum fixed version
17.11.9-0ubuntu18.04.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dpdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, you can limit the use of the affected DPDK versions in your applications until a patch is applied. Ensure that your applications do not process untrusted data that could exploit this vulnerability.
Conclusion
CVE-2020-10723 is a significant memory corruption vulnerability affecting DPDK versions 17.05 and above. Users are encouraged to update their packages to the latest patched versions to mitigate risks associated with this vulnerability. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for dpdk →
FAQ
CVE-2020-10723 is a memory corruption vulnerability found in DPDK versions 17.05 and above, caused by integer truncation on a payload index.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to memory corruption, unauthorized access, or system crashes, compromising the integrity of the affected systems.
Yes, patches are available. Update to DPDK version 17.11.9-0ubuntu18.04.2 for Ubuntu 18.04 LTS or 19.11.1-0ubuntu1.1 for Ubuntu 20.04 LTS.
The CVSS score for CVE-2020-10723 is 6.7, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dpdk.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.