Bug 1879468 (CVE-2020-14375)

Summary:	CVE-2020-14375 dpdk: time-of-check time-of-use vulnerabilities throughout vhost_crypto.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aconole, apevec, chrisw, ctrautma, dblechte, dfediuck, eedri, fleitner, hvyas, jhsiao, linville, mburns, mgoldboi, michal.skrivanek, nhorman, ovs-qe, ovs-team, ralongi, rkhan, sbonazzo, security-response-team, sherold, tredaelli, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dpdk 18.11.10, dpdk 19.11.5	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in dpdk. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-28 20:40:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1883274, 1910489
Bug Blocks:	1879474

Description Dhananjay Arunesh 2020-09-16 11:12:00 UTC

Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. vhost_crypto.c frequently accesses the descriptors directly in the shared memory region. This is not safe. An attacker in the VM can change the contents of the memory after vhost_crypto has validated it. vhost_crypto.c needs to avoid processing data directly in the shared memory region. This can be exploited in the same way as finding number 1 to gain remote code execution and virtual machine escape.

Comment 8 Dave Baker 2020-09-28 15:52:27 UTC

Statement:

This flaw does not affect the versions of `dpdk` as shipped with Red Hat Enterprise Linux 7 and 8 or the versions embedded in Red Hat Virtualization or the Fast Datapath `openvswitch` package, as they do not enable generic crypto device library support. This causes the vulnerable code in vhost_crypto.c to not be included.

This flaw does not affect Red Hat Ceph Storage 3 and 4 as dpdk (embedded in ceph source rpm) is not built in the packages, therefore the vulnerable code is not available in the resulting RPM and the issue cannot be exploited.

Comment 9 Dave Baker 2020-09-28 15:56:51 UTC

Acknowledgments:

Name: Ryan Hall

Comment 10 Dave Baker 2020-09-28 15:56:54 UTC

External References:

https://www.openwall.com/lists/oss-security/2020/09/28/3

Comment 11 Dave Baker 2020-09-28 15:57:19 UTC

Created dpdk tracking bugs for this issue:

Affects: fedora-all [bug 1883274]

Comment 12 Product Security DevOps Team 2020-09-28 20:40:57 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14375