Security update for dpdk SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1430-1 Final 1 1 2020-05-26T15:37:14Z current 2020-05-26T15:37:14Z 2020-05-26T15:37:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dpdk This update for dpdk to 17.11.7 fixes the following issues: Security issues fixed: - CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477 bsc#1171930). - CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1430,SUSE-SLE-SDK-12-SP4-2020-1430,SUSE-SLE-SERVER-12-SP4-2020-1430 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201430-1/ Link for SUSE-SU-2020:1430-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006861.html E-Mail link for SUSE-SU-2020:1430-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171925 SUSE Bug 1171925 https://bugzilla.suse.com/1171930 SUSE Bug 1171930 https://www.suse.com/security/cve/CVE-2019-14818/ SUSE CVE CVE-2019-14818 page https://www.suse.com/security/cve/CVE-2020-10722/ SUSE CVE CVE-2020-10722 page https://www.suse.com/security/cve/CVE-2020-10723/ SUSE CVE CVE-2020-10723 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 dpdk-17.11.7-5.6.2 dpdk-devel-17.11.7-5.6.2 dpdk-doc-17.11.7-5.6.2 dpdk-examples-17.11.7-5.6.2 dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 dpdk-thunderx-17.11.7-5.6.2 dpdk-thunderx-devel-17.11.7-5.6.2 dpdk-thunderx-doc-17.11.7-5.6.2 dpdk-thunderx-examples-17.11.7-5.6.2 dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 dpdk-thunderx-tools-17.11.7-5.6.2 dpdk-tools-17.11.7-5.6.2 libdpdk-17_11-17.11.7-5.6.2 dpdk-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 dpdk-thunderx-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 dpdk-tools-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 libdpdk-17_11-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server 12 SP4 dpdk-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 dpdk-thunderx-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 dpdk-tools-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libdpdk-17_11-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 dpdk-devel-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 dpdk-thunderx-devel-17.11.7-5.6.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition. CVE-2019-14818 SUSE Linux Enterprise Server 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-devel-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-thunderx-devel-17.11.7-5.6.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201430-1/ https://www.suse.com/security/cve/CVE-2019-14818.html CVE-2019-14818 https://bugzilla.suse.com/1156146 SUSE Bug 1156146 A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption. CVE-2020-10722 SUSE Linux Enterprise Server 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-devel-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-thunderx-devel-17.11.7-5.6.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201430-1/ https://www.suse.com/security/cve/CVE-2020-10722.html CVE-2020-10722 https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171930 SUSE Bug 1171930 A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption. CVE-2020-10723 SUSE Linux Enterprise Server 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-thunderx-kmp-default-17.11.7_k4.12.14_95.51-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:dpdk-tools-17.11.7-5.6.2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libdpdk-17_11-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-devel-17.11.7-5.6.2 SUSE Linux Enterprise Software Development Kit 12 SP4:dpdk-thunderx-devel-17.11.7-5.6.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201430-1/ https://www.suse.com/security/cve/CVE-2020-10723.html CVE-2020-10723 https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171925 SUSE Bug 1171925