Security update for dpdk SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0412-1 Final 1 1 2020-02-19T08:36:04Z current 2020-02-19T08:36:04Z 2020-02-19T08:36:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dpdk This update for dpdk to version 18.11.3 fixes the following issues: dpdk was updated to 18.11.3 Security issue fixed: - CVE-2019-14818: Fixed a memory leak vulnerability caused by a malicious container may lead to to denial of service (bsc#1156146). Other issues addressed: - Changed to multibuild (bsc#1151455). - Fixed a regression caused by loading old version drivers (bsc#1157179). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-412,SUSE-SLE-SDK-12-SP5-2020-412,SUSE-SLE-SERVER-12-SP5-2020-412 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200412-1/ Link for SUSE-SU-2020:0412-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006497.html E-Mail link for SUSE-SU-2020:0412-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1151455 SUSE Bug 1151455 https://bugzilla.suse.com/1156146 SUSE Bug 1156146 https://bugzilla.suse.com/1157179 SUSE Bug 1157179 https://www.suse.com/security/cve/CVE-2019-14818/ SUSE CVE CVE-2019-14818 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 dpdk-18.11.3-3.6.1 dpdk-devel-18.11.3-3.6.1 dpdk-doc-18.11.3-3.6.1 dpdk-examples-18.11.3-3.6.1 dpdk-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 dpdk-thunderx-18.11.3-3.6.1 dpdk-thunderx-devel-18.11.3-3.6.1 dpdk-thunderx-doc-18.11.3-3.6.1 dpdk-thunderx-examples-18.11.3-3.6.1 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 dpdk-thunderx-tools-18.11.3-3.6.1 dpdk-tools-18.11.3-3.6.1 libdpdk-18_11-18.11.3-3.6.1 dpdk-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-thunderx-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-tools-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 libdpdk-18_11-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-thunderx-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-tools-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libdpdk-18_11-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-devel-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 dpdk-thunderx-devel-18.11.3-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition. CVE-2019-14818 SUSE Linux Enterprise Server 12 SP5:dpdk-18.11.3-3.6.1 SUSE Linux Enterprise Server 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-18.11.3-3.6.1 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 SUSE Linux Enterprise Server 12 SP5:dpdk-tools-18.11.3-3.6.1 SUSE Linux Enterprise Server 12 SP5:libdpdk-18_11-18.11.3-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-18.11.3-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-18.11.3-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.12-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-tools-18.11.3-3.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdpdk-18_11-18.11.3-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-devel-18.11.3-3.6.1 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-thunderx-devel-18.11.3-3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200412-1/ https://www.suse.com/security/cve/CVE-2019-14818.html CVE-2019-14818 https://bugzilla.suse.com/1156146 SUSE Bug 1156146