CVE-2022-0669: DPDK VHOST_USER FD Exhaustion DoS and RHEL Fix

Key Information Summary Vulnerability Overview CVE ID: CVE-2022-0669 Public Disclosure Date: April 29, 2022 Last Modified Date: September 26, 2025 Severity: Medium CVSS v3 Base Score: 6.5 CVSS v3 Vector: - Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Vulnerability Description A vulnerability was discovered in DPDK that allows a malicious primary vhost user to attach an unexpected number of file descriptors as auxiliary data in VHOST_USER_GET_INFLIGHT_FD/VHOST_USER_SET_INFLIGHT_FD messages. These messages are not cleaned up by the secondary vhost user. By continuously sending such messages, the primary vhost user can exhaust the available file descriptors in the vhost user daemon process, leading to a denial of service. Affected Packages and Related Red Hat Security Advisories Fast Datapath for Red Hat Enterprise Linux 8: - openvswitch2.13: Fixed in RHSA-2022:4786 (May 28, 2022) - openvswitch2.15: Fixed in RHSA-2022:4787 (May 28, 2022) - openvswitch2.16: Fixed in RHSA-2022:4788 (May 28, 2022) Fast Datapath for RHEL 7: - dpdk: Will not fix - openvswitch: Not affected - openvswitch2.11: Not affected - openvswitch2.13: Out of support scope - openvswitch2.15: Out of support scope Fast Datapath for RHEL 8: - openvswitch2.11: Not affected - openvswitch2.17: Not affected CVSS v3 Score Breakdown Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality Impact: None Integrity Impact: None Availability Impact: High Weakness Understanding (CWE) CWE-400: Availability issue; resource allocation under attacker control may lead to denial of service. CWE-770: Availability issue; unlimited resource allocation may lead to denial of service. Acknowledgments Thanks to Cheng Jiang (DPDK Security Team) for the initial report. Frequently Asked Questions (FAQ) Includes FAQs regarding affected products, remediation, and security measures.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-0669: DPDK VHOST_USER FD Exhaustion DoS and RHEL Fix

More from this source