CVE-2021-3839

Published: 29 April 2022

In DPDK Vhost communication, we didn't test if msg->payload.inflight.num_queues is out of bounds in function ‘vhost_user_set_inflight_fd()’, and could cause the program to write OOB.

Priority

Status

Package	Release	Status
dpdk Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
	focal	Released (19.11.12-0ubuntu0.20.04.1)
	impish	Released (20.11.5-0ubuntu1)
	jammy	Released (21.11.1-0ubuntu0.3)
	upstream	Needs triage
	xenial	Not vulnerable (code not present)

Notes

Author	Note
mdeslaur	introduced in 19.11-rc1

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3839
https://ubuntu.com/security/notices/USN-5401-1
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›