TI-2020-11246 Aliases CVE-2020-14378 GHSA-prw9-fq4w-jfrf

Integer underflow in dpdk

LOW 16CWE-191Published 2020-09-30 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.

Why it matters now

EPSS 0.00397 34th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	dpdk	All dpdk versions before 18.11.10 and before 19.11.5	—	No fix listed	CNA

dpdk Vendor— Affected All dpdk versions before 18.11.10 and before 19.11.5 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:dpdk:data_plane_development_kit::::::::	18.02.1 to before 18.11.10; 19.02 to before 19.11.5	Vulnerable	DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	20.04	Vulnerable	Canonical
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.2:::::::*	15.2	Vulnerable	openSUSE

cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions 18.02.1 to before 18.11.10; 19.02 to before 19.11.5 Vulnerable ·DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1593
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
Show all 5 records → Advisory →
Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1599
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
Show all 5 records → Advisory →

Show 1 more group

Advisory · 2020-09-30
dpdk — USN-4550-1
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
- TI-2020-11245 Out-of-bounds read in dpdkPriority LOW 31
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 9	Affected	No fix yet

Not affected: 7 products

Fast Datapath for RHEL 7
Fast Datapath for RHEL 8
Red Hat Ceph Storage 3
Red Hat Ceph Storage 4
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Virtualization 4

Timeline

2026-10-02 Threatist record created from CVE-2020-14378
2026-10-03 Alias added: GHSA-prw9-fq4w-jfrf

References

Patch 1

https://www.openwall.com/lists/oss-security/2020/09/28/3

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences