← back
CVE-2024-11614

Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library

CVSS 7.4 HIGHEPSS 0.6%CWE-125
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.4EPSS 0.6%KEV nãoPoC Nuclei Metasploit Patch referenciado
Lifecycle
18 Dec 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →