CVE-2020-10725

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function virtio_dev_rx_batch_packed().

The versions of dpdk as shipped with Red Hat Enterprise Linux 7 were not affected by this flaw, as they did not include the vulnerable code, which was introduced in a later version of the package. This issue did not affect the versions of ceph as shipped with Red Hat Ceph Storage 3 and 4, as they did not include support for dpdk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.