CVE-2021-3839

2022-08-2315:52:42

CWE-125

redhat

www.cve.org

dpdk

vhost library

memory access

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

46.6%

JSON

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate msg->payload.inflight.num_queues, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

CNA Affected

[
  {
    "product": "dpdk",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in dpdk v22.03"
      }
    ]
  }
]