Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library
Priority LOW 33CWE-125Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Fix Fixed dpdk: 21.11-4Red Hat: 11 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | dpdk | 21.05 to before 21.11-4 | 21.11-4 | Patch available | CNA |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 8 | — | 3.1.0-159.el8fdp | Patch available | CNA |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 9 | — | 3.1.0-149.el9fdp | Patch available | CNA |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 9 | — | 3.3.0-92.el9fdp | Patch available | CNA |
| Red Hat | Fast Datapath for Red Hat Enterprise Linux 9 | — | 3.4.0-48.el9fdp | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 23.11-2.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 21.11-3.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 21.11-3.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 21.11-3.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 21.11-4.el8_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2:23.11-2.el9_5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 2:21.11-3.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 2:22.11-4.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 2:23.11-2.el9_4 | Patch available | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 7 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 8 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | Not affected | CNA |
| Red Hat | Fast Datapath for RHEL 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- dpdk Vendor— Affected 21.05 to before 21.11-4 Fixed in 21.11-4 Patch available CNA
- Fast Datapath for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 3.1.0-159.el8fdp Patch available CNA
- Fast Datapath for Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.1.0-149.el9fdp Patch available CNA
- Fast Datapath for Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.3.0-92.el9fdp Patch available CNA
- Fast Datapath for Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.4.0-48.el9fdp Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 23.11-2.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 21.11-3.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 21.11-3.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 21.11-3.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 21.11-4.el8_8 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2:23.11-2.el9_5 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2:21.11-3.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 2:22.11-4.el9_2 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2:23.11-2.el9_4 Patch available CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Fast Datapath for RHEL 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:8::fastdatapath | 8 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::fastdatapath | 9 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::crb | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:8::fastdatapath Versions 8 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::fastdatapath Versions 9 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::crb Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_eus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
Remediation
- Fix · CNA dpdk Fixed in 21.11-4
Red Hat 11 advisories
- RHSA-2025:3965 Released 2025-04-17 · Red Hat rating Importantopenvswitch3.4 security update
- Fast Datapath for Red Hat Enterprise Linux 9 openvswitch3.4-3.4.0-48.el9fdp, openvswitch3.4-devel-3.4.0-48.el9fdp, openvswitch3.4-ipsec-3.4.0-48.el9fdp +2
- RHSA-2025:3970 Released 2025-04-17 · Red Hat rating Importantopenvswitch3.1 security update
- Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch3.1-3.1.0-159.el8fdp, openvswitch3.1-3.1.0-159.el8fdp, openvswitch3.1-devel-3.1.0-159.el8fdp +3
- RHSA-2025:3964 Released 2025-04-17 · Red Hat rating Importantopenvswitch3.3 security update
- Fast Datapath for Red Hat Enterprise Linux 9 openvswitch3.3-3.3.0-92.el9fdp, openvswitch3.3-devel-3.3.0-92.el9fdp, openvswitch3.3-ipsec-3.3.0-92.el9fdp +2
Show 8 more Red Hat advisories
- RHSA-2025:3963 Released 2025-04-17 · Red Hat rating Importantopenvswitch3.1 security update
- Fast Datapath for Red Hat Enterprise Linux 9 openvswitch3.1-3.1.0-149.el9fdp, openvswitch3.1-devel-3.1.0-149.el9fdp, openvswitch3.1-ipsec-3.1.0-149.el9fdp +2
- RHSA-2025:0222 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream (v. 8) dpdk-23.11-2.el8_10, dpdk-doc-23.11-2.el8_10, dpdk-tools-23.11-2.el8_10
- Red Hat Enterprise Linux CRB (v. 8) dpdk-devel-23.11-2.el8_10
- RHSA-2025:0220 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) dpdk-21.11-4.el8_8, dpdk-devel-21.11-4.el8_8, dpdk-doc-21.11-4.el8_8 +1
- RHSA-2025:0221 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) dpdk-21.11-3.el8_6, dpdk-devel-21.11-3.el8_6, dpdk-doc-21.11-3.el8_6 +1
- Red Hat Enterprise Linux AppStream E4S (v.8.6) dpdk-21.11-3.el8_6, dpdk-devel-21.11-3.el8_6, dpdk-doc-21.11-3.el8_6 +1
- Red Hat Enterprise Linux AppStream TUS (v.8.6) dpdk-21.11-3.el8_6, dpdk-devel-21.11-3.el8_6, dpdk-doc-21.11-3.el8_6 +1
- RHSA-2025:0209 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) dpdk-2:23.11-2.el9_4, dpdk-devel-2:23.11-2.el9_4, dpdk-doc-2:23.11-2.el9_4 +1
- RHSA-2025:0208 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) dpdk-2:22.11-4.el9_2, dpdk-devel-2:22.11-4.el9_2, dpdk-doc-2:22.11-4.el9_2 +1
- RHSA-2025:0210 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream (v. 9) dpdk-2:23.11-2.el9_5, dpdk-devel-2:23.11-2.el9_5, dpdk-doc-2:23.11-2.el9_5 +1
- RHSA-2025:0211 Released 2025-01-09 · Red Hat rating Importantdpdk security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) dpdk-2:21.11-3.el9_0, dpdk-devel-2:21.11-3.el9_0, dpdk-doc-2:21.11-3.el9_0 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fast Datapath for Red Hat Enterprise Linux 8 | Fixed | RHSA-2025:3970 |
| Fast Datapath for Red Hat Enterprise Linux 9 | Fixed | RHSA-2025:3963, RHSA-2025:3964, RHSA-2025:3965 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:0222 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:0210 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:0221 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:0221 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:0211 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2025:0220 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2025:0208 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:0209 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:0221 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2025:0222 |
Not affected: 4 products
- Fast Datapath for RHEL 7
- Fast Datapath for RHEL 8
- Fast Datapath for RHEL 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11614
- 2026-10-03 Alias added: GHSA-hc38-wh54-qgvx
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-11614 · CVE Program
- CVE-2024-11614 · NVD
- FIRST EPSS
- GHSA-hc38-wh54-qgvx · GitHub Advisory Database · CC BY 4.0
- CVE-2024-11614 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences