Bug 1176590 - VUL-0: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: dpdk: VM escape
VUL-0: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-1...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P1 - Urgent : Critical
: ---
Assigned To: Jaime Caamaño Ruiz
Security Team bot
https://smash.suse.de/issue/267477/
CVSSv3.1:SUSE:CVE-2020-14374:8.8:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-09-16 09:53 UTC by Wolfgang Frisch
Modified: 2021-09-13 16:49 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 4 Wolfgang Frisch 2020-09-16 11:22:13 UTC
SUSE:SLE-12-SP2:Update                            Not affected [1]
SUSE:SLE-12-SP3:Update                            Not affected [1]
SUSE:SLE-12-SP3:Update:Products:Teradata:Update   Not affected [1]
SUSE:SLE-12-SP4:Update                            Not affected [1]
SUSE:SLE-12-SP5:Update                            Affected
SUSE:SLE-15:Update                                Affected
SUSE:SLE-15-SP1:Update                            Affected
SUSE:SLE-15-SP2:Update                            Affected

[1] Feature absent.
    Crypto workload support was added to the vhost library with
    DPDK release 18.05, commit e80a98708166e63e87ca4feee792a2378906e0a5
Comment 6 Marcus Meissner 2020-09-28 15:46:12 UTC
is publicd now via oss-sec

From: Ferruh Yigit <ferruh.yigit@intel.com>
Subject: [oss-security] DPDK security advisory for multiple vhost crypto issues
Date: Mon, 28 Sep 2020 16:23:53 +0100

A set of vulnerabilities are fixed in DPDK:
- CVE-2020-14374
- CVE-2020-14375
- CVE-2020-14376
- CVE-2020-14377
- CVE-2020-14378

Some downstream stakeholders were warned in advance in order to coordinate the
release of fixes and reduce the vulnerability window.

Problem:
A malicious guest can harm the host using vhost crypto, this includes
executing code in host (VM Escape), reading host application memory
space to guest and causing partially denial of service in the host.

All users of the vhost library are strongly encouraged to upgrade as soon as
possible.

Thanks to "Ryan Hall <ryan.e.hall@intel.com>" for reporting the issues.


Stable releases download links:

DPDK 18.11.10 (LTS)
http://fast.dpdk.org/rel/dpdk-18.11.10.tar.xz

DPDK 19.11.5 (LTS)
https://fast.dpdk.org/rel/dpdk-19.11.5.tar.xz


Details:

CVE: CVE-2020-14374
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272
Severity: 8.8 (High)
CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary : Remote Code Execution in vhost_crypto (VM Escape)
Reporter: Ryan Hall <ryan.e.hall@intel.com>

CVE: CVE-2020-14375
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272
Severity: 7.8 (High)
CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary : Time-of-check time-of-use vulnerabilities throughout vhost_crypto.c
Reporter: Ryan Hall <ryan.e.hall@intel.com>

CVE: CVE-2020-14376
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272
Severity: 7.8 (High)
CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary : Buffer overflow copying iv_data from guest to
           host(prepare_sym_cipher_op & prepare_sym_chain_op)
Reporter: Ryan Hall <ryan.e.hall@intel.com>

CVE: CVE-2020-14377
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272
Severity: 7.1 (High)
CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary: write_back_data buffer over read (cipher->para.dst_data_len &
          desc->len)
Reporter: Ryan Hall <ryan.e.hall@intel.com>

CVE: CVE-2020-14378
Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272
Severity: 3.3 (Low)
CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary : Partial Denial of Service due to Integer Underflow
Reporter: Ryan Hall <ryan.e.hall@intel.com>


Commits:
main repo (will be 20.11.0)
https://git.dpdk.org/dpdk/commit/?id=57680e34498
https://git.dpdk.org/dpdk/commit/?id=5677e68c05d
https://git.dpdk.org/dpdk/commit/?id=b2866f47336
https://git.dpdk.org/dpdk/commit/?id=409c47c7c5b
https://git.dpdk.org/dpdk/commit/?id=e15b7c01120
https://git.dpdk.org/dpdk/commit/?id=2d962bb7365

DPDK 18.11.10 (LTS)
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ab6314978567
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7a5af91f8bf4
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7e7c75edc635
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ff65dc28bc71
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=75f8df70a2c8
https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=6e8a4da39e68

DPDK 19.11.5 (LTS)
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=3f2635c5a9c3
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=81e969483020
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e4a7c14f0248
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=319b498e4b16
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=6a3a414698e4
https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e2666ec24535

-- 
DPDK Security Team
http://core.dpdk.org/security/
Comment 7 Swamp Workflow Management 2020-09-28 19:13:31 UTC
SUSE-SU-2020:2768-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    dpdk-18.11.9-3.15.1, dpdk-thunderx-18.11.9-3.15.1
SUSE Linux Enterprise Server 12-SP5 (src):    dpdk-18.11.9-3.15.1, dpdk-thunderx-18.11.9-3.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2020-09-28 19:14:19 UTC
SUSE-SU-2020:2769-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    dpdk-18.11.9-4.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-09-28 19:15:09 UTC
SUSE-SU-2020:2767-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    dpdk-18.11.9-3.25.1
SUSE Linux Enterprise Server 15-LTSS (src):    dpdk-18.11.9-3.25.1, dpdk-thunderx-18.11.9-3.25.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    dpdk-18.11.9-3.25.1, dpdk-thunderx-18.11.9-3.25.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    dpdk-18.11.9-3.25.1, dpdk-thunderx-18.11.9-3.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-09-28 19:16:00 UTC
SUSE-SU-2020:2770-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    dpdk-19.11.4-3.9.1, dpdk-thunderx-19.11.4-3.9.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (src):    dpdk-19.11.4-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2020-10-03 10:16:26 UTC
openSUSE-SU-2020:1593-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    dpdk-18.11.9-lp151.3.8.1
Comment 13 Swamp Workflow Management 2020-10-04 04:17:07 UTC
openSUSE-SU-2020:1599-1: An update that fixes 5 vulnerabilities is now available.

Category: security (critical)
Bug References: 1176590
CVE References: CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    dpdk-19.11.4-lp152.2.8.1
Comment 14 Marcus Meissner 2020-10-07 06:54:08 UTC
released