Read the docs
TI-2022-00584 Aliases CVE-2022-0669GHSA-4vw6-hh56-rxvj

Uncontrolled resource consumption in DPDK

Priority LOW 29CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Why it matters now

EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DPDKAffects v19.11-rc1 and later, Fixed in v22.03-rc4.—No fix listedCNA
  • DPDK Vendor— Affected Affects v19.11-rc1 and later, Fixed in v22.03-rc4. Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:*20.02 to before 22.03VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:19.11:*:*:*:*:*:*:*19.11VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc1:*:*:*:*:*:*19.11 rc1VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc2:*:*:*:*:*:*19.11 rc2VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc3:*:*:*:*:*:*19.11 rc3VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc4:*:*:*:*:*:*19.11 rc4VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc1:*:*:*:*:*:*22.03 rc1VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc2:*:*:*:*:*:*22.03 rc2VulnerableDPDK
cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc3:*:*:*:*:*:*22.03 rc3VulnerableDPDK
cpe:2.3:a:openvswitch:openvswitch:2.13.0:*:*:*:*:*:*:*2.13.0VulnerableOpenvswitch
  • cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions 20.02 to before 22.03 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.11:*:*:*:*:*:*:* Versions 19.11 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc1:*:*:*:*:*:* Versions 19.11 rc1 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc2:*:*:*:*:*:* Versions 19.11 rc2 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc3:*:*:*:*:*:* Versions 19.11 rc3 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:19.11:rc4:*:*:*:*:*:* Versions 19.11 rc4 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc1:*:*:*:*:*:* Versions 22.03 rc1 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc2:*:*:*:*:*:* Versions 22.03 rc2 Vulnerable ·DPDK
  • cpe:2.3:a:dpdk:data_plane_development_kit:22.03:rc3:*:*:*:*:*:* Versions 22.03 rc3 Vulnerable ·DPDK
  • cpe:2.3:a:openvswitch:openvswitch:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 Vulnerable ·Openvswitch
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openvswitch:openvswitch:2.15.0:*:*:*:*:*:*:*2.15.0VulnerableOpenvswitch
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:openvswitch:openvswitch:2.15.0:*:*:*:*:*:*:* Versions 2.15.0 Vulnerable ·Openvswitch
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2022:4786 Released 2022-05-27 · Red Hat rating Moderate
    openvswitch2.13 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.13-2.13.0-180.el8fdp
  • RHSA-2022:4788 Released 2022-05-27 · Red Hat rating Moderate
    openvswitch2.16 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.16-2.16.0-74.el8fdp
  • RHSA-2022:4787 Released 2022-05-27 · Red Hat rating Moderate
    openvswitch2.15 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.15-2.15.0-99.el8fdp

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fast Datapath for RHEL 7AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Fast Datapath for Red Hat Enterprise Linux 8Fixed RHSA-2022:4786, RHSA-2022:4787, RHSA-2022:4788
Not affected: 6 products
  • Fast Datapath for RHEL 7
  • Fast Datapath for RHEL 8
  • Fast Datapath for Red Hat Enterprise Linux 8
  • Red Hat Ceph Storage 4
  • Red Hat Enterprise Linux 9
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0669
  2. 2026-10-03 Alias added: GHSA-4vw6-hh56-rxvj

References

Patch 4

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences