CVE-2021-3839: dpdk data plane development kit +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-3839

CVSS 7.5 · High EPSS 1,6%

Kerentanan Out-of-bounds Read pada dpdk data plane development kit, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

Rincian

Terbit di NVD: 23 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-125: Out-of-bounds Read
CWE-787: Out-of-bounds Write
EPSS (30 hari): 1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
dpdk	data plane development kit	Semua versi sebelum 22.03
dpdk	data plane development kit	Versi 22.03 rc1
dpdk	data plane development kit	Versi 22.03 rc2
dpdk	data plane development kit	Versi 22.03 rc3
fedoraproject	fedora	Versi 35
redhat	enterprise linux	Versi 7.0
redhat	enterprise linux	Versi 8.0
redhat	enterprise linux	Versi 9.0
redhat	enterprise linux fast datapath	Versi 7.0
redhat	enterprise linux fast datapath	Versi 8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugzilla.redhat.com/show_bug.cgi?id=2025882 issue tracking · patch · advisory pihak ketiga
https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5 patch · advisory pihak ketiga
https://access.redhat.com/security/cve/CVE-2021-3839 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.