The vulnerability of the rte_raw_cksum_mbuf() function in the vhost library, part of the libraries and drivers for fast packet processing by DPDK, allows a attacker to cause a service failure.

The vulnerability of the rterawcksummbuf function in the vhost library, which is part of the DPDK toolkit for fast packet processing, stems from a failure to properly manage the output beyond the buffer in memory when calculating the checksum. Exploiting this vulnerability could allow an attacker...

SUSE CVE-2024-11614

An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using...

USN-7178-1 dpdk vulnerability

It was discovered that DPDK incorrectly handled the Vhost library checksum offload feature. An malicious guest could possibly use this issue to cause the hypervisor's vSwitch to crash, resulting in a denial of service...

CVE-2024-53269 Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to...

AZL-54455 CVE-2024-11614 affecting package dpdk for versions less than 23.11.3-1

An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using...

UBUNTU-CVE-2024-11614

An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using...

Envoy Proxy 安全漏洞

Envoy Proxy is a cloud-native, high-performance edge/intermediate/service proxy open-sourced by Envoy Proxy. A security vulnerability exists in Envoy Proxy that stems from a sorting algorithm that crashes in the data plane when other addresses are not IP addresses...

DPDK Vhost Library 缓冲区错误漏洞

The DPDK Vhost Library is a library of user-space implementations of the vhost protocol from the DPDK organization. A buffer error vulnerability exists in the DPDK Vhost Library, which stems from the presence of a buffer overflow vulnerability that could result in a denial of service or arbitrary...

PT-2024-17611 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane versions up to 1.6.1 Description: A critical vulnerability affects the upload file function of the file "/index.php/upload/upload file/1/1". The manipulation of the file argument leads to unrestricted upload. The attack can be...

CVE-2024-55582

Oxide before 6 has unencrypted Control Plane datastores...

Oxide 安全漏洞

Oxide is a cloud platform from Oxide, Inc. A security vulnerability exists in versions prior to Oxide 6 that stems from having unencrypted control plane data storage...

CVE-2024-55582

Oxide before 6 has unencrypted Control Plane datastores...

CVE-2024-55582

CVE-2024-55582 affects Oxide prior to version 6, where the control plane datastores are unencrypted. Root cause: storage of control plane data without encryption. Impact (per sources): potential exposure or modification of sensitive control-plane information, reflected in the CVSS vector (high co...

CVE-2023-50913

Oxide control plane software before 5 allows SSRF...

CVE-2023-50913

Oxide control plane software before 5 allows SSRF...

CVE-2023-50913

The CVE-2023-50913 entry refers to the Oxide control plane software prior to version 5, where a Server-Side Request Forgery (SSRF) vulnerability is present. The issue affects the Oxide control plane software and is characterized by SSRF with high impact to confidentiality and integrity (per CVSS ...

PT-2024-14005 · Oxide · Oxide

Name of the Vulnerable Software and Affected Versions: Oxide control plane software versions prior to 5 Description: The issue allows Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external systems. This can...

CVE-2023-50913

Oxide control plane software before 5 allows SSRF...

CVE-2024-50274

In the Linux kernel, the following vulnerability has been resolved: idpf: avoid vport access in idpfgetlinkksettings When the device control plane is removed or the platform running device control plane is rebooted, a reset is detected on the driver. On driver reset, it releases the resources and...

SUSE CVE-2024-53064

In the Linux kernel, the following vulnerability has been resolved: idpf: fix idpfvccoreinit error path In an event where the platform running the device control plane is rebooted, reset is detected on the driver. It releases all the resources and waits for the reset to complete. Once the reset i...