CVE-2018-1059

dpdk: Information exposure in unchecked guest physical to host virtual address translations

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.0

Review impact separately from score.

Published · April 23, 2018

Updated · June 28, 2026

Description

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory.

Statement

Red Hat OpenStack Platform versions 7 to 9 provided openvswitch-dpdk as a technical preview for customers, it was provided without support and is not intended on being deployed in production.

Red Hat Ceph Storage version 3 provides ceph bundled with DPDK as a technical preview for customers. It was provided without support and is not intended on being deployed in production.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.1
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor