Test ID:	1.3.6.1.4.1.25623.1.1.2.2020.2428
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for dpdk (EulerOS-SA-2020-2428)
Summary:	The remote host is missing an update for the Huawei EulerOS 'dpdk' package(s) announced via the EulerOS-SA-2020-2428 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'dpdk' package(s) announced via the EulerOS-SA-2020-2428 advisory. Vulnerability Insight: A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-14374) A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-14375) A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2020-14376) A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.(CVE-2020-14377) An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in a long running loop. An attacker could cause `move_desc` to get stuck in a 4.294.967.295-count iteration loop. Depending on how `vhost_crypto` is being used this could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period.(CVE-2020-14378) Affected Software/OS: 'dpdk' package(s) on Huawei EulerOS V2.0SP9(x86_64). Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-14374 https://bugzilla.redhat.com/show_bug.cgi?id=1879466 https://www.openwall.com/lists/oss-security/2020/09/28/3 http://www.openwall.com/lists/oss-security/2021/01/04/1 http://www.openwall.com/lists/oss-security/2021/01/04/2 http://www.openwall.com/lists/oss-security/2021/01/04/5 SuSE Security Announcement: openSUSE-SU-2020:1593 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html SuSE Security Announcement: openSUSE-SU-2020:1599 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html Common Vulnerability Exposure (CVE) ID: CVE-2020-14375 https://bugzilla.redhat.com/show_bug.cgi?id=1879468 https://usn.ubuntu.com/4550-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14376 https://bugzilla.redhat.com/show_bug.cgi?id=1879470 Common Vulnerability Exposure (CVE) ID: CVE-2020-14377 https://bugzilla.redhat.com/show_bug.cgi?id=1879472 Common Vulnerability Exposure (CVE) ID: CVE-2020-14378 https://bugzilla.redhat.com/show_bug.cgi?id=1879473
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.