From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (xvm-189-124.dc0.ghst.net [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CF5C1A0A01; Mon, 4 Jan 2021 12:27:59 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 54C5C1606E0; Mon, 4 Jan 2021 12:27:59 +0100 (CET) Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by mails.dpdk.org (Postfix) with ESMTP id 9DCDE1606DB; Mon, 4 Jan 2021 12:27:57 +0100 (CET) IronPort-SDR: Nu9tNMuPV/X8KpZkoZZ+zikSIq6CJT08symPXag8TDr7L+zMYH0rsMQyJjODd9Gwd9U1dleNkh 6CwuIy3CCXtQ== X-IronPort-AV: E=McAfee;i="6000,8403,9853"; a="174364371" X-IronPort-AV: E=Sophos;i="5.78,473,1599548400"; d="scan'208";a="174364371" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Jan 2021 03:27:56 -0800 IronPort-SDR: PIXFe52iCDDwtP1chaBaHfNuIer/kHTQQBpKv+915PGmkDd/cp96CC+w76UYfv/+s40ORkPM9W UBIKX2pxpTxg== X-IronPort-AV: E=Sophos;i="5.78,473,1599548400"; d="scan'208";a="378382351" Received: from fyigit-mobl1.ger.corp.intel.com (HELO [10.251.93.148]) ([10.251.93.148]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Jan 2021 03:27:54 -0800 To: Mauro Matteo Cascella , oss-security@lists.openwall.com Cc: security@dpdk.org, security-prerelease@dpdk.org, "dev@dpdk.org" , Ryan Hall References: <73386a14-6e5a-83e4-051d-125b5c5fe5d9@intel.com> From: Ferruh Yigit Message-ID: <69a35308-0697-780d-8e72-422c7a2173d8@intel.com> Date: Mon, 4 Jan 2021 11:27:50 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Subject: Re: [dpdk-dev] [oss-security] DPDK security advisory for multiple vhost crypto issues X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 1/4/2021 8:28 AM, Mauro Matteo Cascella wrote: > Hello, > > Is there any particular reason for the Scope metric to be Unchanged > (S:U) for CVE-2020-14377 and CVE-2020-14378? > removed dpdk-announce mail list Hi Mauro, CVE-2020-14377, the memory over read is in the scope of the same application, that is the reason of the unchanged scope. There is another CVE below that can use this information to figure out where to overwrite for remote execution which has scope set as 'Changed'. CVE-2020-14378, can cause loop taken longer time and delays the service, since it is eating the core cycles, if there is something else using that specific core technically it may delay it too, but DPDK mostly uses all core for itself and since mainly the vhost crypto service is affected, scope selected as Unchanged. Is there a concern on the selected scope metric? Thanks. > Thank you, > > On Mon, Sep 28, 2020 at 5:43 PM Ferruh Yigit wrote: >> >> A set of vulnerabilities are fixed in DPDK: >> - CVE-2020-14374 >> - CVE-2020-14375 >> - CVE-2020-14376 >> - CVE-2020-14377 >> - CVE-2020-14378 >> >> Some downstream stakeholders were warned in advance in order to coordinate the >> release of fixes and reduce the vulnerability window. >> >> Problem: >> A malicious guest can harm the host using vhost crypto, this includes >> executing code in host (VM Escape), reading host application memory >> space to guest and causing partially denial of service in the host. >> >> All users of the vhost library are strongly encouraged to upgrade as soon as >> possible. >> >> Thanks to "Ryan Hall " for reporting the issues. >> >> >> Stable releases download links: >> >> DPDK 18.11.10 (LTS) >> http://fast.dpdk.org/rel/dpdk-18.11.10.tar.xz >> >> DPDK 19.11.5 (LTS) >> https://fast.dpdk.org/rel/dpdk-19.11.5.tar.xz >> >> >> Details: >> >> CVE: CVE-2020-14374 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 8.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Remote Code Execution in vhost_crypto (VM Escape) >> Reporter: Ryan Hall >> >> CVE: CVE-2020-14375 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Time-of-check time-of-use vulnerabilities throughout vhost_crypto.c >> Reporter: Ryan Hall >> >> CVE: CVE-2020-14376 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Buffer overflow copying iv_data from guest to >> host(prepare_sym_cipher_op & prepare_sym_chain_op) >> Reporter: Ryan Hall >> >> CVE: CVE-2020-14377 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.1 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H >> Summary: write_back_data buffer over read (cipher->para.dst_data_len & >> desc->len) >> Reporter: Ryan Hall >> >> CVE: CVE-2020-14378 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 3.3 (Low) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L >> Summary : Partial Denial of Service due to Integer Underflow >> Reporter: Ryan Hall >> >> >> Commits: >> main repo (will be 20.11.0) >> https://git.dpdk.org/dpdk/commit/?id=57680e34498 >> https://git.dpdk.org/dpdk/commit/?id=5677e68c05d >> https://git.dpdk.org/dpdk/commit/?id=b2866f47336 >> https://git.dpdk.org/dpdk/commit/?id=409c47c7c5b >> https://git.dpdk.org/dpdk/commit/?id=e15b7c01120 >> https://git.dpdk.org/dpdk/commit/?id=2d962bb7365 >> >> DPDK 18.11.10 (LTS) >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ab6314978567 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7a5af91f8bf4 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7e7c75edc635 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ff65dc28bc71 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=75f8df70a2c8 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=6e8a4da39e68 >> >> DPDK 19.11.5 (LTS) >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=3f2635c5a9c3 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=81e969483020 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e4a7c14f0248 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=319b498e4b16 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=6a3a414698e4 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e2666ec24535 >> >> -- >> DPDK Security Team >> http://core.dpdk.org/security/ >>