Security update for dpdk SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1552-1 Final 1 1 2020-06-08T07:32:41Z current 2020-06-08T07:32:41Z 2020-06-08T07:32:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dpdk This update for dpdk fixes the following issues: - CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171930). - CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171925). - CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171926). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1552,SUSE-SLE-SDK-12-SP5-2020-1552,SUSE-SLE-SERVER-12-SP5-2020-1552 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201552-1/ Link for SUSE-SU-2020:1552-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/006899.html E-Mail link for SUSE-SU-2020:1552-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171925 SUSE Bug 1171925 https://bugzilla.suse.com/1171926 SUSE Bug 1171926 https://bugzilla.suse.com/1171930 SUSE Bug 1171930 https://www.suse.com/security/cve/CVE-2020-10722/ SUSE CVE CVE-2020-10722 page https://www.suse.com/security/cve/CVE-2020-10723/ SUSE CVE CVE-2020-10723 page https://www.suse.com/security/cve/CVE-2020-10724/ SUSE CVE CVE-2020-10724 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 dpdk-18.11.3-3.9.2 dpdk-devel-18.11.3-3.9.2 dpdk-doc-18.11.3-3.9.2 dpdk-examples-18.11.3-3.9.2 dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 dpdk-thunderx-18.11.3-3.9.2 dpdk-thunderx-devel-18.11.3-3.9.2 dpdk-thunderx-doc-18.11.3-3.9.2 dpdk-thunderx-examples-18.11.3-3.9.2 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 dpdk-thunderx-tools-18.11.3-3.9.2 dpdk-tools-18.11.3-3.9.2 libdpdk-18_11-18.11.3-3.9.2 dpdk-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-thunderx-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-tools-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 libdpdk-18_11-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server 12 SP5 dpdk-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-thunderx-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-tools-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libdpdk-18_11-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 dpdk-devel-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 dpdk-thunderx-devel-18.11.3-3.9.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption. CVE-2020-10722 SUSE Linux Enterprise Server 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-devel-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-thunderx-devel-18.11.3-3.9.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201552-1/ https://www.suse.com/security/cve/CVE-2020-10722.html CVE-2020-10722 https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171930 SUSE Bug 1171930 A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption. CVE-2020-10723 SUSE Linux Enterprise Server 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-devel-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-thunderx-devel-18.11.3-3.9.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201552-1/ https://www.suse.com/security/cve/CVE-2020-10723.html CVE-2020-10723 https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171925 SUSE Bug 1171925 A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read. CVE-2020-10724 SUSE Linux Enterprise Server 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-thunderx-kmp-default-18.11.3_k4.12.14_122.20-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:dpdk-tools-18.11.3-3.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libdpdk-18_11-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-devel-18.11.3-3.9.2 SUSE Linux Enterprise Software Development Kit 12 SP5:dpdk-thunderx-devel-18.11.3-3.9.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201552-1/ https://www.suse.com/security/cve/CVE-2020-10724.html CVE-2020-10724 https://bugzilla.suse.com/1171477 SUSE Bug 1171477 https://bugzilla.suse.com/1171926 SUSE Bug 1171926