CVE-2021-3839

HIGH

DPDK - Memory Corruption

Title source: llm
STIX 2.1

Description

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

References (3)

Core 3
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2025882
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-3839

Scores

CVSS v3 7.5
EPSS 0.0059
EPSS Percentile 69.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-125 CWE-787
Status published
Products (8)
dpdk/data_plane_development_kit 22.03 rc1 (3 CPE variants)
dpdk/data_plane_development_kit < 22.03
fedoraproject/fedora 35
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
redhat/enterprise_linux 9.0
redhat/enterprise_linux_fast_datapath 7.0
redhat/enterprise_linux_fast_datapath 8.0
Published Aug 23, 2022
Tracked Since Feb 18, 2026