LOW 3.3 Microsoft
CVE-2020-14378
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.
Microsoft Security Update 2020-Sep: An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.
Affected Products
- azl3 ceph 18.2.2-8 on Azure Linux 3.0
- azl3 ceph 18.2.2-1 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-14378
- https://nvd.nist.gov/vuln/detail/CVE-2020-14378
This low severity vulnerability with a CVSS score of 3.3 was published on 2020-09-08 via Microsoft. Affected: azl3 ceph 18.2.2-8 on Azure Linux 3.0, azl3 ceph 18.2.2-1 on Azure Linux 3.0.
vulnfeed aggregates 9909 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.