Read the docs
TI-2022-01973 Aliases CVE-2022-2132GHSA-m6j8-qrc2-r53c

A permissive list of allowed inputs flaw was found in DPDK.

Priority MEDIUM 42CWE-791Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

Why it matters now

EPSS 0.02389 84th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 16 advisoriesRed Hat: 15 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—dpdkdpdk 21.11, dpdk 20.11, dpdk 19.11—No fix listedCNA
  • dpdk Vendor— Affected dpdk 21.11, dpdk 20.11, dpdk 19.11 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:*before 19.11; 20.0 to before 20.11; 21.0 to before 21.11VulnerableDPDK
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:enterprise_linux_fast_datapath:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions before 19.11; 20.0 to before 20.11; 21.0 to before 21.11 Vulnerable ·DPDK
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:enterprise_linux_fast_datapath:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:enterprise_linux_fast_datapath:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:enterprise_linux_fast_datapath:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 16 advisories

  • RHSA-2023:0171 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream (v. 8) dpdk-21.11-2.el8_7, dpdk-devel-21.11-2.el8_7, dpdk-doc-21.11-2.el8_7 +1
  • RHSA-2023:0170 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) dpdk-21.11-2.el8_6, dpdk-devel-21.11-2.el8_6, dpdk-doc-21.11-2.el8_6 +1
  • RHSA-2023:0169 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) dpdk-20.11-4.el8_4, dpdk-devel-20.11-4.el8_4, dpdk-doc-20.11-4.el8_4 +1
Show 13 more Red Hat advisories
  • RHSA-2023:0172 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) dpdk-2:21.11-2.el9_0, dpdk-devel-2:21.11-2.el9_0, dpdk-doc-2:21.11-2.el9_0 +1
  • RHSA-2023:0166 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) dpdk-19.11-6.el8_2, dpdk-devel-19.11-6.el8_2, dpdk-doc-19.11-6.el8_2 +1
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) dpdk-19.11-6.el8_2, dpdk-devel-19.11-6.el8_2, dpdk-doc-19.11-6.el8_2 +1
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) dpdk-19.11-6.el8_2, dpdk-devel-19.11-6.el8_2, dpdk-doc-19.11-6.el8_2 +1
  • RHSA-2023:0168 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) dpdk-18.11.2-5.el8_1, dpdk-devel-18.11.2-5.el8_1, dpdk-doc-18.11.2-5.el8_1 +1
  • RHSA-2023:0167 Released 2023-01-16 · Red Hat rating Important
    dpdk security update
    • Red Hat Enterprise Linux 7 Extras dpdk-18.11.8-2.el7_9, dpdk-devel-18.11.8-2.el7_9, dpdk-doc-18.11.8-2.el7_9 +1
  • RHSA-2022:8263 Released 2022-11-15 · Red Hat rating Important
    dpdk security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) dpdk-2:21.11.2-1.el9_1, dpdk-devel-2:21.11.2-1.el9_1, dpdk-doc-2:21.11.2-1.el9_1 +1
  • RHSA-2022:7268 Released 2022-11-01 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 (openvswitch2.11) security update
    • Red Hat OpenStack Platform 13.0 - ELS openvswitch2.11-2.11.3-96.2.el7fdp, openvswitch2.11-devel-2.11.3-96.2.el7fdp, openvswitch2.11-test-2.11.3-96.2.el7fdp +1
  • RHSA-2022:6850 Released 2022-10-06 · Red Hat rating Important
    openvswitch2.11 security update
    • Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.11-2.11.3-96.2.el7fdp, openvswitch2.11-devel-2.11.3-96.2.el7fdp, openvswitch2.11-test-2.11.3-96.2.el7fdp +1
  • RHSA-2022:6551 Released 2022-09-19 · Red Hat rating Important
    Red Hat Virtualization security update
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.2-202209140405_8.6, redhat-virtualization-host-image-update-4.5.2-202209140405_8.6
  • RHSA-2022:6385 Released 2022-09-07 · Red Hat rating Important
    openvswitch2.15 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.15-2.15.0-113.2.el8fdp, openvswitch2.15-2.15.0-113.2.el8fdp, openvswitch2.15-devel-2.15.0-113.2.el8fdp +3
  • RHSA-2022:6386 Released 2022-09-07 · Red Hat rating Important
    openvswitch2.17 security update
    • Fast Datapath for Red Hat Enterprise Linux 9 openvswitch2.17-2.17.0-32.3.el9fdp, openvswitch2.17-devel-2.17.0-32.3.el9fdp, openvswitch2.17-ipsec-2.17.0-32.3.el9fdp +2
  • RHSA-2022:6382 Released 2022-09-07 · Red Hat rating Important
    openvswitch2.16 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.16-2.16.0-89.2.el8fdp, openvswitch2.16-2.16.0-89.2.el8fdp, openvswitch2.16-devel-2.16.0-89.2.el8fdp +3
  • RHSA-2022:6383 Released 2022-09-07 · Red Hat rating Important
    openvswitch2.17 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.17-2.17.0-37.3.el8fdp, openvswitch2.17-2.17.0-37.3.el8fdp, openvswitch2.17-devel-2.17.0-37.3.el8fdp +3
  • RHSA-2022:6384 Released 2022-09-07 · Red Hat rating Important
    openvswitch2.13 security update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.13-2.13.0-193.2.el8fdp, openvswitch2.13-2.13.0-193.2.el8fdp, openvswitch2.13-devel-2.13.0-193.2.el8fdp +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fast Datapath for RHEL 7AffectedNo fix yet
Fast Datapath for RHEL 8AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Fast Datapath for Red Hat Enterprise Linux 7Fixed RHSA-2022:6850
Fast Datapath for Red Hat Enterprise Linux 8Fixed RHSA-2022:6382, RHSA-2022:6383, RHSA-2022:6384, RHSA-2022:6385
Fast Datapath for Red Hat Enterprise Linux 9Fixed RHSA-2022:6386
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2023:0167
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0171
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8263
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:0166
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:0168
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:0166
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:0169
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:0170
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:0172
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:0166
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2022:7268
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2022:6551
Not affected: 5 products
  • Fast Datapath for RHEL 7
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat OpenStack Platform 13 (Queens)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2132
  2. 2026-10-03 Alias added: GHSA-m6j8-qrc2-r53c

References

Exploit 2

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences