-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: openvswitch2.13 security, bug fix and enhancement update Advisory ID: RHSA-2020:2295-01 Product: Fast Datapath Advisory URL: https://access.redhat.com/errata/RHSA-2020:2295 Issue date: 2020-05-26 CVE Names: CVE-2020-10722 CVE-2020-10723 CVE-2020-10724 CVE-2020-10725 CVE-2020-10726 ==================================================================== 1. Summary: An update for openvswitch2.13 is now available for Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Fast Datapath for Red Hat Enterprise Linux 8 - noarch, ppc64le, s390x, x86_64 3. Description: Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic. Security Fix(es): * dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor (CVE-2020-10725) * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722) * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723) * dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724) * dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * DPDK virtio_user lack of notifications make vhost_net+napi stops tx buffers (BZ#1803082) * Update internal DPDK to 19.11.1 (BZ#1824825) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1803082 - DPDK virtio_user lack of notifications make vhost_net+napi stops tx buffers 1824825 - Update internal DPDK to 19.11.1 1828867 - CVE-2020-10722 dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() 1828874 - CVE-2020-10723 dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() 1828884 - CVE-2020-10724 dpdk: librte_vhost Missing inputs validation in Vhost-crypto 1828894 - CVE-2020-10725 dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor 1828898 - CVE-2020-10726 dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS 6. Package List: Fast Datapath for Red Hat Enterprise Linux 8: Source: openvswitch2.13-2.13.0-25.el8fdp.1.src.rpm noarch: openvswitch2.13-test-2.13.0-25.el8fdp.1.noarch.rpm ppc64le: network-scripts-openvswitch2.13-2.13.0-25.el8fdp.1.ppc64le.rpm openvswitch2.13-2.13.0-25.el8fdp.1.ppc64le.rpm openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.ppc64le.rpm openvswitch2.13-debugsource-2.13.0-25.el8fdp.1.ppc64le.rpm openvswitch2.13-devel-2.13.0-25.el8fdp.1.ppc64le.rpm python3-openvswitch2.13-2.13.0-25.el8fdp.1.ppc64le.rpm python3-openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.ppc64le.rpm s390x: network-scripts-openvswitch2.13-2.13.0-25.el8fdp.1.s390x.rpm openvswitch2.13-2.13.0-25.el8fdp.1.s390x.rpm openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.s390x.rpm openvswitch2.13-debugsource-2.13.0-25.el8fdp.1.s390x.rpm openvswitch2.13-devel-2.13.0-25.el8fdp.1.s390x.rpm python3-openvswitch2.13-2.13.0-25.el8fdp.1.s390x.rpm python3-openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.s390x.rpm x86_64: network-scripts-openvswitch2.13-2.13.0-25.el8fdp.1.x86_64.rpm openvswitch2.13-2.13.0-25.el8fdp.1.x86_64.rpm openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.x86_64.rpm openvswitch2.13-debugsource-2.13.0-25.el8fdp.1.x86_64.rpm openvswitch2.13-devel-2.13.0-25.el8fdp.1.x86_64.rpm python3-openvswitch2.13-2.13.0-25.el8fdp.1.x86_64.rpm python3-openvswitch2.13-debuginfo-2.13.0-25.el8fdp.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10722 https://access.redhat.com/security/cve/CVE-2020-10723 https://access.redhat.com/security/cve/CVE-2020-10724 https://access.redhat.com/security/cve/CVE-2020-10725 https://access.redhat.com/security/cve/CVE-2020-10726 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXsz8UtzjgjWX9erEAQjAvg//YdSjFtu1nSomH8he5jYFrLM7ACuNWWmj LZwRzBBOJeSgH43ii8LDrEuP1SmDM5zZ1/MPdpg72weHOszkgehj27jBjIJgF2wr dmwP+lP2ZnRtegrfZvHLSqseYfcVzJOVwb8z0OamBT5xMwsG7aoCtZN8kEQGjhNX A8+MzJo6W1kXGbNkKCHLu3dsxK1pwb2tqIQGe47XpEOft6jTTg++ZvGA9Azn/VVG aQWOhRrHDkLwjqCDrUI1lL2jtqsA6GvbellQHyqsIld3IVfqQBXEkbUUNFK4CbKP ypX35sSU1sIm++wwcbtvKVVr9ufhMy7Qa1IYwWI9yreRDAl1Um9tgQoAVStV86a6 9tVHOy76mAEe9FPj6IVN6+mwCQ51F+JmD09BfeRZWrOfiND4ZvnSINm3iiVSi+MW fLeR5jEz1KCIHSahQlkKSk8q72/3GeT0wRZWwsfpGDJwLoND5eEPvQFhuf6egd5z hKhlODyB8beEEm4MPc+MGzvkKHpax/rsUBe9G/V0zvp8iEiPuMRWvtHyOc+4ENHZ UTAvx1cvCSB7UU6/9xHHm/JJaGbI8wPeRomZlgsdDcz9+3hoit11833MGii3rjjH SK32OE7DIhVqmUzfK6cGamKxpX7n4C7M18kGVIPCsYePplwdZgX/YTe1LxWZmc5o VO7DxmwXFgE=JUAb -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce