Read the docs
TI-2020-08621 Aliases CVE-2020-10722GHSA-63gx-gp99-wcgc

Integer overflow in [UNKNOWN] dpdk

Priority LOW 30CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

Why it matters now

EPSS 0.00378 31st percentileScored 2026-11-07
Fix Partial Red Hat: 8 advisoriesRed Hat: 8 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]dpdk20.02.1; 19.11.2; 18.11.8—No fix listedCNA
  • dpdk Vendor[UNKNOWN] Affected 20.02.1; 19.11.2; 18.11.8 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:*up to 18.05VulnerableDPDK
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*19.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:oracle:communications_session_border_controller:*:*:*:*:*:*:*:*8.2 – 8.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
  • cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions up to 18.05 Vulnerable ·DPDK
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:oracle:communications_session_border_controller:*:*:*:*:*:*:*:* Versions 8.2 – 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle

Remediation

Red Hat 8 advisories

  • RHSA-2021:0931 Released 2021-03-18 · Red Hat rating Important
    openvswitch2.11 and ovn2.11 security update
    • Red Hat OpenStack Platform 13.0 openvswitch-selinux-extra-policy-1.0-17.el7fdp, openvswitch2.11-2.11.3-77.el7fdp, openvswitch2.11-devel-2.11.3-77.el7fdp +6
  • RHSA-2020:4806 Released 2020-11-04 · Red Hat rating Important
    dpdk security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) dpdk-19.11.3-1.el8, dpdk-devel-19.11.3-1.el8, dpdk-doc-19.11.3-1.el8 +1
  • RHSA-2020:4114 Released 2020-09-30 · Red Hat rating Moderate
    Red Hat Virtualization security and bug fix update
    • RHV-M 4.3 openvswitch2.11-2.11.0-54.20200327gita4efc59.el7fdp, openvswitch2.11-devel-2.11.0-54.20200327gita4efc59.el7fdp, ovn2.11-2.11.1-44.el7fdp +3
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts openvswitch2.11-2.11.0-54.20200327gita4efc59.el7fdp, openvswitch2.11-devel-2.11.0-54.20200327gita4efc59.el7fdp, ovn2.11-2.11.1-44.el7fdp +3
Show 5 more Red Hat advisories
  • RHSA-2020:2683 Released 2020-06-23 · Red Hat rating Moderate
    dpdk security, bug fix, and enhancement update
    • Red Hat Enterprise Linux 7 Extras dpdk-18.11.8-1.el7_8, dpdk-devel-18.11.8-1.el7_8, dpdk-doc-18.11.8-1.el7_8 +1
  • RHSA-2020:2296 Released 2020-05-26 · Red Hat rating Moderate
    openvswitch2.11 security, bug fix and enhancement update
    • Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.11-2.11.0-54.20200327gita4efc59.el7fdp, openvswitch2.11-devel-2.11.0-54.20200327gita4efc59.el7fdp, openvswitch2.11-test-2.11.0-54.20200327gita4efc59.el7fdp +1
  • RHSA-2020:2298 Released 2020-05-26 · Red Hat rating Moderate
    openvswitch security, bug fix and enhancement update
    • Fast Datapath for Red Hat Enterprise Linux 7 openvswitch-2.9.0-130.el7fdp, openvswitch-devel-2.9.0-130.el7fdp, openvswitch-ovn-central-2.9.0-130.el7fdp +5
    • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch-2.9.0-130.el7fdp, openvswitch-devel-2.9.0-130.el7fdp, openvswitch-ovn-common-2.9.0-130.el7fdp +2
  • RHSA-2020:2297 Released 2020-05-26 · Red Hat rating Moderate
    openvswitch2.11 security, bug fix and enhancement update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.11-2.11.0-54.20200327gita4efc59.el8fdp, openvswitch2.11-2.11.0-54.20200327gita4efc59.el8fdp, openvswitch2.11-devel-2.11.0-54.20200327gita4efc59.el8fdp +2
  • RHSA-2020:2295 Released 2020-05-26 · Red Hat rating Important
    openvswitch2.13 security, bug fix and enhancement update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.13-2.13.0-25.el8fdp.1, openvswitch2.13-2.13.0-25.el8fdp.1, openvswitch2.13-devel-2.13.0-25.el8fdp.1 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    [UNKNOWN] dpdk — openSUSE-SU-2020:0693

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2020-08624 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a…Priority LOW 38
    • TI-2020-08622 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    • TI-2020-08625 Integer overflow in [UNKNOWN] dpdkPriority LOW 27
    Show all 5 records → Advisory →
  • Advisory ·

    [UNKNOWN] dpdk — FEDORA-2020-04e3d34451

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2020-08624 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a…Priority LOW 38
    • TI-2020-08622 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    • TI-2020-08625 Integer overflow in [UNKNOWN] dpdkPriority LOW 27
    Show all 5 records → Advisory →
Show 1 more group
  • Advisory ·

    [UNKNOWN] dpdk — USN-4362-1

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fast Datapath for RHEL 7AffectedNo fix planned: Will not fix
Fast Datapath for RHEL 8AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Fast Datapath for Red Hat Enterprise Linux 7Fixed RHSA-2020:2296, RHSA-2020:2298
Fast Datapath for Red Hat Enterprise Linux 8Fixed RHSA-2020:2295, RHSA-2020:2297
RHV-M 4.3Fixed RHSA-2020:4114
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2020:2683
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4806
Red Hat OpenStack Platform 13.0Fixed RHSA-2021:0931
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2020:4114
Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS HostsFixed RHSA-2020:2298
Not affected: 8 products
  • Fast Datapath for RHEL 7
  • RHV-M 4.3
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat OpenStack Platform 15 (Stein)
  • Red Hat OpenStack Platform 16 (Train)
  • Red Hat Virtualization 4 Hypervisor for RHEL 7
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10722
  2. 2026-10-03 Alias added: GHSA-63gx-gp99-wcgc

References

Patch 3

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences