Security update for dpdk SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:3179-1 Final 1 1 2019-12-05T10:42:09Z current 2019-12-05T10:42:09Z 2019-12-05T10:42:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dpdk This update of dpdk to version 18.11.3 provides the following fixes: dpdk was updated to 18.11.3 (fate#327817, bsc#1145713, jsc#ECO-274, fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jsc#SLE-4715) Security issue fixed: - CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicius container may lead to to denial of service (bsc#1156146). Other issues addressed: - Fixed a regression by inserting version numbers to the drivers (bsc#1157179). - Changed to multibuild (bsc#1151455). - Added support for using externally allocated memory in DPDK. - Added check for ensuring allocated memory is addressable by devices. - Updated the C11 memory model version of the ring library. - Added NXP CAAM JR PMD. - Added support for GEN3 devices to Intel QAT driver. - Added Distributed Software Eventdev PMD. - Updated KNI kernel module, rte_kni library, and KNI sample application. - Add a new sample application for vDPA. - Updated mlx5 driver. * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves. * Reworked flow engine to supported e-switch flow rules (transfer attribute). * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules. * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules. * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors. * Added support for meson build. * Fixed build issue with PPC. * Added support for BlueField VF. * Added support for externally allocated static memory for DMA. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-3179,SUSE-SLE-Module-Server-Applications-15-2019-3179 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20193179-1/ Link for SUSE-SU-2019:3179-1 https://lists.suse.com/pipermail/sle-security-updates/2019-December/006215.html E-Mail link for SUSE-SU-2019:3179-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1134968 SUSE Bug 1134968 https://bugzilla.suse.com/1145713 SUSE Bug 1145713 https://bugzilla.suse.com/1151455 SUSE Bug 1151455 https://bugzilla.suse.com/1156146 SUSE Bug 1156146 https://bugzilla.suse.com/1157179 SUSE Bug 1157179 https://www.suse.com/security/cve/CVE-2019-14818/ SUSE CVE CVE-2019-14818 page https://bugzilla.suse.com/ECO-274 SUSE Bug ECO-274 https://bugzilla.suse.com/SLE-4715 SUSE Bug SLE-4715 SUSE Linux Enterprise Module for Server Applications 15 dpdk-18.11.3-3.16.1 dpdk-devel-18.11.3-3.16.1 dpdk-doc-18.11.3-3.16.1 dpdk-examples-18.11.3-3.16.1 dpdk-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 dpdk-thunderx-18.11.3-3.16.1 dpdk-thunderx-devel-18.11.3-3.16.1 dpdk-thunderx-doc-18.11.3-3.16.1 dpdk-thunderx-examples-18.11.3-3.16.1 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 dpdk-thunderx-tools-18.11.3-3.16.1 dpdk-tools-18.11.3-3.16.1 libdpdk-18_11-18.11.3-3.16.1 dpdk-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-devel-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-thunderx-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-thunderx-devel-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 dpdk-tools-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 libdpdk-18_11-18.11.3-3.16.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition. CVE-2019-14818 SUSE Linux Enterprise Module for Server Applications 15:dpdk-18.11.3-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-devel-18.11.3-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-thunderx-18.11.3-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-thunderx-devel-18.11.3-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_150.41-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:dpdk-tools-18.11.3-3.16.1 SUSE Linux Enterprise Module for Server Applications 15:libdpdk-18_11-18.11.3-3.16.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193179-1/ https://www.suse.com/security/cve/CVE-2019-14818.html CVE-2019-14818 https://bugzilla.suse.com/1156146 SUSE Bug 1156146