Memory leak in dpdk
Priority LOW 38CWE-401Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-401.
Summary
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
Why it matters now
EPSS 0.02815 86th percentileScored 2026-11-07
Fix Partial dpdk (DPDK): 17.11.8, 16.11.10, 18.11.4 +1Red Hat: 7 advisoriesRed Hat: 7 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DPDK | dpdk | 17.x to before 17.11.8; 16.x to before 16.11.10; 18.x to before 18.11.4; 19.x to before 19.08.1 | 17.11.8, 16.11.10, 18.11.4, 19.08.1 | Patch available | CNA |
- dpdk VendorDPDK Affected 17.x to before 17.11.8; 16.x to before 16.11.10; 18.x to before 18.11.4; 19.x to before 19.08.1 Fixed in 17.11.8, 16.11.10, 18.11.4, 19.08.1 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* | 16.04 to before 16.11.10; 17.02 to before 17.11.8; 18.02 to before 18.11.4; 19.02 to before 19.08.1 | Vulnerable | DPDK |
| cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* | 10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_eus:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
- cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions 16.04 to before 16.11.10; 17.02 to before 17.11.8; 18.02 to before 18.11.4; 19.02 to before 19.08.1 Vulnerable ·DPDK
- cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_eus:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA dpdk (DPDK) Fixed in 17.11.8, 16.11.10, 18.11.4, 19.08.1
Red Hat 7 advisories
- RHSA-2020:1735 Released 2020-04-28 · Red Hat rating Moderatedpdk security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) dpdk-19.11-4.el8, dpdk-devel-19.11-4.el8, dpdk-doc-19.11-4.el8 +1
- RHSA-2020:1226 Released 2020-04-01 · Red Hat rating Moderatedpdk security, bug fix, and enhancement update
- Red Hat Enterprise Linux 7 Extras dpdk-18.11.5-1.el7_8, dpdk-devel-18.11.5-1.el7_8, dpdk-doc-18.11.5-1.el7_8 +1
- RHSA-2020:0172 Released 2020-01-22 · Red Hat rating Moderateopenvswitch2.12 security and bug fix update
- Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.12-2.12.0-12.el8fdp, openvswitch2.12-2.12.0-12.el8fdp, openvswitch2.12-devel-2.12.0-12.el8fdp +2
Show 4 more Red Hat advisories
- RHSA-2020:0171 Released 2020-01-22 · Red Hat rating Moderateopenvswitch2.11 security and bug fix update
- Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.11-2.11.0-35.el8fdp, openvswitch2.11-2.11.0-35.el8fdp, openvswitch2.11-devel-2.11.0-35.el8fdp +2
- RHSA-2020:0168 Released 2020-01-21 · Red Hat rating Moderateopenvswitch2.12 security and bug fix update
- Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.12-2.12.0-12.el7fdp, openvswitch2.12-devel-2.12.0-12.el7fdp, openvswitch2.12-test-2.12.0-12.el7fdp +1
- RHSA-2020:0166 Released 2020-01-21 · Red Hat rating Moderateopenvswitch2.11 security and bug fix update
- Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.11-2.11.0-35.el7fdp, openvswitch2.11-devel-2.11.0-35.el7fdp, openvswitch2.11-test-2.11.0-35.el7fdp +1
- RHSA-2020:0165 Released 2020-01-21 · Red Hat rating Moderateopenvswitch security and bug fix update
- Fast Datapath for Red Hat Enterprise Linux 7 openvswitch-2.9.0-124.el7fdp, openvswitch-devel-2.9.0-124.el7fdp, openvswitch-ovn-central-2.9.0-124.el7fdp +5
- Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch-2.9.0-124.el7fdp, openvswitch-devel-2.9.0-124.el7fdp, openvswitch-ovn-common-2.9.0-124.el7fdp +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fast Datapath for RHEL 7 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Out of support scope |
| Fast Datapath for Red Hat Enterprise Linux 7 | Fixed | RHSA-2020:0165, RHSA-2020:0166, RHSA-2020:0168 |
| Fast Datapath for Red Hat Enterprise Linux 8 | Fixed | RHSA-2020:0171, RHSA-2020:0172 |
| Red Hat Enterprise Linux 7 Extras | Fixed | RHSA-2020:1226 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:1735 |
| Red Hat OpenStack Platform 13.0 | Fixed | — |
| Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server | Fixed | — |
| Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts | Fixed | RHSA-2020:0165 |
Not affected: 3 products
- Fast Datapath for RHEL 8
- Red Hat Ceph Storage 3
- Red Hat OpenStack Platform 10 (Newton)
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14818
- 2026-10-03 Alias added: GHSA-c968-9rc6-v8jv
References
More DPDK Data Plane Development Kit vulnerabilities
- TI-2022-01973 A permissive list of allowed inputs flaw was found in DPDK. CVSS 3.1HIGH 8.6
- TI-2020-11242 Buffer overflow in dpdk CVSS 3.1HIGH 8.8
- TI-2020-08624 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a… CVSS 3.1HIGH 7.7
- TI-2021-02770 Out-of-bounds read in dpdk CVSS 3.1HIGH 7.5
- TI-2020-11244 Buffer overflow in dpdk CVSS 3.1HIGH 7.8
- TI-2020-11243 Time-of-check time-of-use race condition in dpdk CVSS 3.1HIGH 7.8
Sources
- CVE-2019-14818 · CVE Program
- CVE-2019-14818 · NVD
- FIRST EPSS
- GHSA-c968-9rc6-v8jv · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14818 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences