CVE-2020-10722

Published: May 19, 2020Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

Affected (9)

Products: Dpdk: Data Plane Development Kit · Canonical: Ubuntu Linux · Fedoraproject: Fedora · +2 more

Show all products

Dpdk: Data Plane Development Kit · Canonical: Ubuntu Linux · Fedoraproject: Fedora · Opensuse: Leap · Oracle: Communications Session Border Controller, Enterprise Communications Broker

1 product

Data Plane Development Kit

1 product

1 product

1 product

2 products

Communications Session Border Controller

Enterprise Communications Broker

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dpdk Data Plane Development Kit	Up to 18.05

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10
Canonical Ubuntu Linux	Version 20.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Session Border Controller	From 8.2 to 8.4
Oracle Enterprise Communications Broker	Version 3.1.0
Oracle Enterprise Communications Broker	Version 3.2.0

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bugs.dpdk.org/show_bug.cgi?id=267

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10722

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/

Source: secalert@redhat.com

https://usn.ubuntu.com/4362-1/

Source: secalert@redhat.com

Third Party Advisory

https://www.openwall.com/lists/oss-security/2020/05/18/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugs.dpdk.org/show_bug.cgi?id=267

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10722

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/4362-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openwall.com/lists/oss-security/2020/05/18/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.