* [dpdk-dev] DPDK security advisory for multiple vhost crypto issues @ 2020-09-28 15:23 Ferruh Yigit 2021-01-04 8:28 ` [dpdk-dev] [oss-security] " Mauro Matteo Cascella 0 siblings, 1 reply; 4+ messages in thread From: Ferruh Yigit @ 2020-09-28 15:23 UTC (permalink / raw) To: dpdk-announce; +Cc: security, security-prerelease, oss-security, dev A set of vulnerabilities are fixed in DPDK: - CVE-2020-14374 - CVE-2020-14375 - CVE-2020-14376 - CVE-2020-14377 - CVE-2020-14378 Some downstream stakeholders were warned in advance in order to coordinate the release of fixes and reduce the vulnerability window. Problem: A malicious guest can harm the host using vhost crypto, this includes executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host. All users of the vhost library are strongly encouraged to upgrade as soon as possible. Thanks to "Ryan Hall <ryan.e.hall@intel.com>" for reporting the issues. Stable releases download links: DPDK 18.11.10 (LTS) http://fast.dpdk.org/rel/dpdk-18.11.10.tar.xz DPDK 19.11.5 (LTS) https://fast.dpdk.org/rel/dpdk-19.11.5.tar.xz Details: CVE: CVE-2020-14374 Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 Severity: 8.8 (High) CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Summary : Remote Code Execution in vhost_crypto (VM Escape) Reporter: Ryan Hall <ryan.e.hall@intel.com> CVE: CVE-2020-14375 Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 Severity: 7.8 (High) CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Summary : Time-of-check time-of-use vulnerabilities throughout vhost_crypto.c Reporter: Ryan Hall <ryan.e.hall@intel.com> CVE: CVE-2020-14376 Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 Severity: 7.8 (High) CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Summary : Buffer overflow copying iv_data from guest to host(prepare_sym_cipher_op & prepare_sym_chain_op) Reporter: Ryan Hall <ryan.e.hall@intel.com> CVE: CVE-2020-14377 Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 Severity: 7.1 (High) CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Summary: write_back_data buffer over read (cipher->para.dst_data_len & desc->len) Reporter: Ryan Hall <ryan.e.hall@intel.com> CVE: CVE-2020-14378 Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 Severity: 3.3 (Low) CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Summary : Partial Denial of Service due to Integer Underflow Reporter: Ryan Hall <ryan.e.hall@intel.com> Commits: main repo (will be 20.11.0) https://git.dpdk.org/dpdk/commit/?id=57680e34498 https://git.dpdk.org/dpdk/commit/?id=5677e68c05d https://git.dpdk.org/dpdk/commit/?id=b2866f47336 https://git.dpdk.org/dpdk/commit/?id=409c47c7c5b https://git.dpdk.org/dpdk/commit/?id=e15b7c01120 https://git.dpdk.org/dpdk/commit/?id=2d962bb7365 DPDK 18.11.10 (LTS) https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ab6314978567 https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7a5af91f8bf4 https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7e7c75edc635 https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ff65dc28bc71 https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=75f8df70a2c8 https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=6e8a4da39e68 DPDK 19.11.5 (LTS) https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=3f2635c5a9c3 https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=81e969483020 https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e4a7c14f0248 https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=319b498e4b16 https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=6a3a414698e4 https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e2666ec24535 -- DPDK Security Team http://core.dpdk.org/security/ ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dpdk-dev] [oss-security] DPDK security advisory for multiple vhost crypto issues 2020-09-28 15:23 [dpdk-dev] DPDK security advisory for multiple vhost crypto issues Ferruh Yigit @ 2021-01-04 8:28 ` Mauro Matteo Cascella 2021-01-04 11:27 ` Ferruh Yigit 0 siblings, 1 reply; 4+ messages in thread From: Mauro Matteo Cascella @ 2021-01-04 8:28 UTC (permalink / raw) To: oss-security; +Cc: dpdk-announce, security, security-prerelease, dev Hello, Is there any particular reason for the Scope metric to be Unchanged (S:U) for CVE-2020-14377 and CVE-2020-14378? Thank you, On Mon, Sep 28, 2020 at 5:43 PM Ferruh Yigit <ferruh.yigit@intel.com> wrote: > > A set of vulnerabilities are fixed in DPDK: > - CVE-2020-14374 > - CVE-2020-14375 > - CVE-2020-14376 > - CVE-2020-14377 > - CVE-2020-14378 > > Some downstream stakeholders were warned in advance in order to coordinate the > release of fixes and reduce the vulnerability window. > > Problem: > A malicious guest can harm the host using vhost crypto, this includes > executing code in host (VM Escape), reading host application memory > space to guest and causing partially denial of service in the host. > > All users of the vhost library are strongly encouraged to upgrade as soon as > possible. > > Thanks to "Ryan Hall <ryan.e.hall@intel.com>" for reporting the issues. > > > Stable releases download links: > > DPDK 18.11.10 (LTS) > http://fast.dpdk.org/rel/dpdk-18.11.10.tar.xz > > DPDK 19.11.5 (LTS) > https://fast.dpdk.org/rel/dpdk-19.11.5.tar.xz > > > Details: > > CVE: CVE-2020-14374 > Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 > Severity: 8.8 (High) > CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H > Summary : Remote Code Execution in vhost_crypto (VM Escape) > Reporter: Ryan Hall <ryan.e.hall@intel.com> > > CVE: CVE-2020-14375 > Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 > Severity: 7.8 (High) > CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H > Summary : Time-of-check time-of-use vulnerabilities throughout vhost_crypto.c > Reporter: Ryan Hall <ryan.e.hall@intel.com> > > CVE: CVE-2020-14376 > Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 > Severity: 7.8 (High) > CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H > Summary : Buffer overflow copying iv_data from guest to > host(prepare_sym_cipher_op & prepare_sym_chain_op) > Reporter: Ryan Hall <ryan.e.hall@intel.com> > > CVE: CVE-2020-14377 > Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 > Severity: 7.1 (High) > CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H > Summary: write_back_data buffer over read (cipher->para.dst_data_len & > desc->len) > Reporter: Ryan Hall <ryan.e.hall@intel.com> > > CVE: CVE-2020-14378 > Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 > Severity: 3.3 (Low) > CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L > Summary : Partial Denial of Service due to Integer Underflow > Reporter: Ryan Hall <ryan.e.hall@intel.com> > > > Commits: > main repo (will be 20.11.0) > https://git.dpdk.org/dpdk/commit/?id=57680e34498 > https://git.dpdk.org/dpdk/commit/?id=5677e68c05d > https://git.dpdk.org/dpdk/commit/?id=b2866f47336 > https://git.dpdk.org/dpdk/commit/?id=409c47c7c5b > https://git.dpdk.org/dpdk/commit/?id=e15b7c01120 > https://git.dpdk.org/dpdk/commit/?id=2d962bb7365 > > DPDK 18.11.10 (LTS) > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ab6314978567 > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7a5af91f8bf4 > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7e7c75edc635 > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ff65dc28bc71 > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=75f8df70a2c8 > https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=6e8a4da39e68 > > DPDK 19.11.5 (LTS) > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=3f2635c5a9c3 > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=81e969483020 > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e4a7c14f0248 > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=319b498e4b16 > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=6a3a414698e4 > https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e2666ec24535 > > -- > DPDK Security Team > http://core.dpdk.org/security/ > > > > > > > > -- Mauro Matteo Cascella Red Hat Product Security PGP-Key ID: BB3410B0 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dpdk-dev] [oss-security] DPDK security advisory for multiple vhost crypto issues 2021-01-04 8:28 ` [dpdk-dev] [oss-security] " Mauro Matteo Cascella @ 2021-01-04 11:27 ` Ferruh Yigit 2021-01-04 13:27 ` Mauro Matteo Cascella 0 siblings, 1 reply; 4+ messages in thread From: Ferruh Yigit @ 2021-01-04 11:27 UTC (permalink / raw) To: Mauro Matteo Cascella, oss-security Cc: security, security-prerelease, dev, Ryan Hall On 1/4/2021 8:28 AM, Mauro Matteo Cascella wrote: > Hello, > > Is there any particular reason for the Scope metric to be Unchanged > (S:U) for CVE-2020-14377 and CVE-2020-14378? > removed dpdk-announce mail list Hi Mauro, CVE-2020-14377, the memory over read is in the scope of the same application, that is the reason of the unchanged scope. There is another CVE below that can use this information to figure out where to overwrite for remote execution which has scope set as 'Changed'. CVE-2020-14378, can cause loop taken longer time and delays the service, since it is eating the core cycles, if there is something else using that specific core technically it may delay it too, but DPDK mostly uses all core for itself and since mainly the vhost crypto service is affected, scope selected as Unchanged. Is there a concern on the selected scope metric? Thanks. > Thank you, > > On Mon, Sep 28, 2020 at 5:43 PM Ferruh Yigit <ferruh.yigit@intel.com> wrote: >> >> A set of vulnerabilities are fixed in DPDK: >> - CVE-2020-14374 >> - CVE-2020-14375 >> - CVE-2020-14376 >> - CVE-2020-14377 >> - CVE-2020-14378 >> >> Some downstream stakeholders were warned in advance in order to coordinate the >> release of fixes and reduce the vulnerability window. >> >> Problem: >> A malicious guest can harm the host using vhost crypto, this includes >> executing code in host (VM Escape), reading host application memory >> space to guest and causing partially denial of service in the host. >> >> All users of the vhost library are strongly encouraged to upgrade as soon as >> possible. >> >> Thanks to "Ryan Hall <ryan.e.hall@intel.com>" for reporting the issues. >> >> >> Stable releases download links: >> >> DPDK 18.11.10 (LTS) >> http://fast.dpdk.org/rel/dpdk-18.11.10.tar.xz >> >> DPDK 19.11.5 (LTS) >> https://fast.dpdk.org/rel/dpdk-19.11.5.tar.xz >> >> >> Details: >> >> CVE: CVE-2020-14374 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 8.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Remote Code Execution in vhost_crypto (VM Escape) >> Reporter: Ryan Hall <ryan.e.hall@intel.com> >> >> CVE: CVE-2020-14375 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Time-of-check time-of-use vulnerabilities throughout vhost_crypto.c >> Reporter: Ryan Hall <ryan.e.hall@intel.com> >> >> CVE: CVE-2020-14376 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.8 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H >> Summary : Buffer overflow copying iv_data from guest to >> host(prepare_sym_cipher_op & prepare_sym_chain_op) >> Reporter: Ryan Hall <ryan.e.hall@intel.com> >> >> CVE: CVE-2020-14377 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 7.1 (High) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H >> Summary: write_back_data buffer over read (cipher->para.dst_data_len & >> desc->len) >> Reporter: Ryan Hall <ryan.e.hall@intel.com> >> >> CVE: CVE-2020-14378 >> Bugzilla: https://bugs.dpdk.org/show_bug.cgi?id=272 >> Severity: 3.3 (Low) >> CVSS scores: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L >> Summary : Partial Denial of Service due to Integer Underflow >> Reporter: Ryan Hall <ryan.e.hall@intel.com> >> >> >> Commits: >> main repo (will be 20.11.0) >> https://git.dpdk.org/dpdk/commit/?id=57680e34498 >> https://git.dpdk.org/dpdk/commit/?id=5677e68c05d >> https://git.dpdk.org/dpdk/commit/?id=b2866f47336 >> https://git.dpdk.org/dpdk/commit/?id=409c47c7c5b >> https://git.dpdk.org/dpdk/commit/?id=e15b7c01120 >> https://git.dpdk.org/dpdk/commit/?id=2d962bb7365 >> >> DPDK 18.11.10 (LTS) >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ab6314978567 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7a5af91f8bf4 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=7e7c75edc635 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=ff65dc28bc71 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=75f8df70a2c8 >> https://git.dpdk.org/dpdk-stable/commit/?h=18.11&id=6e8a4da39e68 >> >> DPDK 19.11.5 (LTS) >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=3f2635c5a9c3 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=81e969483020 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e4a7c14f0248 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=319b498e4b16 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=6a3a414698e4 >> https://git.dpdk.org/dpdk-stable/commit/?h=19.11&id=e2666ec24535 >> >> -- >> DPDK Security Team >> http://core.dpdk.org/security/ >> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dpdk-dev] [oss-security] DPDK security advisory for multiple vhost crypto issues 2021-01-04 11:27 ` Ferruh Yigit @ 2021-01-04 13:27 ` Mauro Matteo Cascella 0 siblings, 0 replies; 4+ messages in thread From: Mauro Matteo Cascella @ 2021-01-04 13:27 UTC (permalink / raw) To: Ferruh Yigit; +Cc: oss-security, security, security-prerelease, dev, Ryan Hall On Mon, Jan 4, 2021 at 12:29 PM Ferruh Yigit <ferruh.yigit@intel.com> wrote: > > On 1/4/2021 8:28 AM, Mauro Matteo Cascella wrote: > > Hello, > > > > Is there any particular reason for the Scope metric to be Unchanged > > (S:U) for CVE-2020-14377 and CVE-2020-14378? > > > > removed dpdk-announce mail list > > Hi Mauro, > > CVE-2020-14377, the memory over read is in the scope of the same application, > that is the reason of the unchanged scope. There is another CVE below that can > use this information to figure out where to overwrite for remote execution which > has scope set as 'Changed'. > > CVE-2020-14378, can cause loop taken longer time and delays the service, since > it is eating the core cycles, if there is something else using that specific > core technically it may delay it too, but DPDK mostly uses all core for itself > and since mainly the vhost crypto service is affected, scope selected as Unchanged. > > Is there a concern on the selected scope metric? > > Thanks. > Thank you for the timely reply. With regard to CVE-2020-14377, the Scope metric was rated differently by NIST [1] hence my initial question. [1] https://nvd.nist.gov/vuln/detail/CVE-2020-14377 > > On Mon, Sep 28, 2020 at 5:43 PM Ferruh Yigit <ferruh.yigit@intel.com> wrote: > >> > >> A set of vulnerabilities are fixed in DPDK: > >> - CVE-2020-14374 > >> - CVE-2020-14375 > >> - CVE-2020-14376 > >> - CVE-2020-14377 > >> - CVE-2020-14378 > >> > >> Some downstream stakeholders were warned in advance in order to coordinate the > >> release of fixes and reduce the vulnerability window. > >> > >> Problem: > >> A malicious guest can harm the host using vhost crypto, this includes > >> executing code in host (VM Escape), reading host application memory > >> space to guest and causing partially denial of service in the host. > >> From the problem statement above I assume all these CVEs lead to some kind of guest-to-host compromise, which usually implies a Scope change (or at least, this holds true for QEMU flaws). Therefore I was wondering what's the reason behind the different evaluation of the Scope metric between CVE-2020-14377 and the others. Regards. -- Mauro Matteo Cascella Red Hat Product Security PGP-Key ID: BB3410B0 ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-01-04 13:28 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-09-28 15:23 [dpdk-dev] DPDK security advisory for multiple vhost crypto issues Ferruh Yigit 2021-01-04 8:28 ` [dpdk-dev] [oss-security] " Mauro Matteo Cascella 2021-01-04 11:27 ` Ferruh Yigit 2021-01-04 13:27 ` Mauro Matteo Cascella
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).