CVE-2018-1059
published 2018-04-24CVE-2018-1059: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical…
PriorityP425medium6.1CVSS 3.0
AVAACHPRNUINSCCHINAN
EPSS
0.85%
57.7th percentile
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | dpdk | < dpdk 17.11.2-1 (bookworm) | dpdk 17.11.2-1 (bookworm) |
| dpdk | data_plane_development_kit | < 18.02.1 | 18.02.1 |
| dpdk | dpdk | — | — |
| dpdk | dpdk | >= 0 < 17.11.2-1 | 17.11.2-1 |
| dpdk | dpdk | >= 0 < 17.11.2-1 | 17.11.2-1 |
| dpdk | dpdk | >= 0 < 17.11.2-1 | 17.11.2-1 |
| dpdk | dpdk | >= 0 < 17.11.2-1 | 17.11.2-1 |
| openvswitch | openvswitch | — | — |
| redhat | ceph_storage | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_fast_datapath | — | — |
| redhat | openshift | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | virtualization | — | — |
| redhat | virtualization | — | — |
| redhat | virtualization_manager | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv2.02.9LOWAV:A/AC:M/Au:N/C:P/I:N/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
vendor_redhat·2026-10-14·CVSS 6.1
CVE-2026-93683 [MEDIUM] CWE-367 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of t
Ubuntu
DPDK vulnerability
vendor_ubuntu·2018-05-16
CVE-2018-1059 DPDK vulnerability
Title: DPDK vulnerability
Summary: DPDK could be made to expose sensitive information over the network.
USN-3642-1 fixed a vulnerability in DPDK. This update provides the
corresponding update for Ubuntu 17.10.
Original advisory details:
Maxime Coquelin discovered that DPDK incorrectly handled guest physical
ranges. A malicious guest could use this issue to possibly access sensitive
information.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
DPDK vulnerability
vendor_ubuntu·2018-05-09
CVE-2018-1059 DPDK vulnerability
Title: DPDK vulnerability
Summary: DPDK could be made to expose sensitive information over the network.
Maxime Coquelin discovered that DPDK incorrectly handled guest physical
ranges. A malicious guest could use this issue to possibly access sensitive
information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dpdk: Information exposure in unchecked guest physical to host virtual address translations
vendor_redhat·2018-04-23·CVSS 6.1
CVE-2018-1059 [MEDIUM] CWE-200 dpdk: Information exposure in unchecked guest physical to host virtual address translations
dpdk: Information exposure in unchecked guest physical to host virtual address translations
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory.
Statement: Red Hat OpenStack Platform versions 7 to 9 provided openvswitch-dpdk as a technica
Debian
CVE-2018-1059: dpdk - The DPDK vhost-user interface does not check to verify that all the requested gu...
vendor_debian·2018·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059: dpdk - The DPDK vhost-user interface does not check to verify that all the requested gu...
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
Scope: local
bookworm: resolved (fixed in 17.11.2-1)
bullseye: resolved (fixed in 17.11.2-1)
forky: resolved (fixed in 17.11.2-1)
sid: resolved (fixed in 17.11.2-1)
trixie: resolved (fixed in 17.11.2-1)
GHSA
A flaw was found in the DPDK vhost library.
ghsa_unreviewed·2026-10-14·CVSS 6.1
CVE-2026-93683 [MEDIUM] CWE-367 A flaw was found in the DPDK vhost library.
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
GHSA
GHSA-ww8j-hjq3-7m8r: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Phys
ghsa_unreviewed·2022-05-13
CVE-2018-1059 [MEDIUM] CWE-200 GHSA-ww8j-hjq3-7m8r: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Phys
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
OSV
CVE-2018-1059: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Phys
osv·2018-04-24·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059: The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Phys
The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
bugzilla·2026-10-14·CVSS 6.1
CVE-2026-93683 [MEDIUM] CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can cra
Bugzilla
CVE-2026-93683 grout: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
bugzilla·2026-10-14·CVSS 6.1
CVE-2026-93683 [MEDIUM] CVE-2026-93683 grout: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
CVE-2026-93683 grout: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can cr
Bugzilla
CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
bugzilla·2026-09-18·CVSS 6.1
CVE-2026-93683 [MEDIUM] CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduc
Bugzilla
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
bugzilla·2018-04-24·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
+++ This bug was initially created as a clone of Bug #1570865 +++
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fi
Bugzilla
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
bugzilla·2018-04-24·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
+++ This bug was initially created as a clone of Bug #1570865 +++
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fi
Bugzilla
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
bugzilla·2018-04-23·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations
bugzilla·2018-02-12·CVSS 6.1
CVE-2018-1059 [MEDIUM] CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations
CVE-2018-1059 dpdk: Information exposure in unchecked guest physical to host virtual address translations
The DPDK vhost-user interface does not check all the requested guest physical range is mapped and contiguous when performing Guest Physical Adresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory.
Discussion:
Statement:
Red Hat OpenStack Platform versions 7 to 9 provided openvswitch-dpdk as a technical preview for customers, it was provided without support and is not intended on being deployed in production.
Red Hat Ceph Storage version 3 provides ceph bundled with DPDK as a technical preview for customers. It was provided without support and is not intended on being deployed in production.
---
Is the vulnera
Bugzilla
CVE-2018-6616 openjpeg2: Excessive iteration in openjp2/t1.c:opj_t1_encode_cblks can allow for denial of service via crafted BMP file
bugzilla·2018-02-06·CVSS 5.5
CVE-2018-6616 [MEDIUM] CVE-2018-6616 openjpeg2: Excessive iteration in openjp2/t1.c:opj_t1_encode_cblks can allow for denial of service via crafted BMP file
CVE-2018-6616 openjpeg2: Excessive iteration in openjp2/t1.c:opj_t1_encode_cblks can allow for denial of service via crafted BMP file
In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Upstream Issue:
https://github.com/uclouvain/openjpeg/issues/1059
Discussion:
Created openjpeg2 tracking bugs for this issue:
Affects: epel-all [bug 1542322]
Affects: fedora-all [bug 1542323]
---
Created attachment 1554622
Upstream patch
---
Statement:
This issue did not affect Red Hat Enterprise Linux 7.6 and older versions as they didn't include support for openjpeg2.
https://access.redhat.com/errata/RHSA-2018:1267https://access.redhat.com/errata/RHSA-2018:2038https://access.redhat.com/errata/RHSA-2018:2102https://access.redhat.com/errata/RHSA-2018:2524https://access.redhat.com/security/cve/cve-2018-1059https://bugzilla.redhat.com/show_bug.cgi?id=1544298https://usn.ubuntu.com/3642-1/https://usn.ubuntu.com/3642-2/https://access.redhat.com/errata/RHSA-2018:1267https://access.redhat.com/errata/RHSA-2018:2038https://access.redhat.com/errata/RHSA-2018:2102https://access.redhat.com/errata/RHSA-2018:2524https://access.redhat.com/security/cve/cve-2018-1059https://bugzilla.redhat.com/show_bug.cgi?id=1544298https://usn.ubuntu.com/3642-1/https://usn.ubuntu.com/3642-2/
2018-04-24
Published