CVE-2022-28199

CWE-1284CWE-20 — Improper Input ValidationCWE-390CWE-3938 documents8 sources
Severity
8.6HIGH
EPSS
0.8%
top 25.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia Data Plane Development KITNvidia Nvidia Flare
Timeline
PublishedSep 1
Latest updateApr 15

Description

NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDnvidia/data_plane_development_kit19.11_1.0.0 — 20.11_5.0.0
▶Debiandpdk< 20.11.6-1~deb11u1+3
▶CVEListV5nvidia/nvidia_flaremlnx_dpdk_19.11_1.*.* through mlnx_dpdk_20.11_1.0.0-4.*.*

🔴Vulnerability Details

3
GHSA
GHSA-x5mv-h4g3-j3r2: NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled↗2022-09-02
▶
OSV
CVE-2022-28199: NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled↗2022-09-01
▶
CVEList
CVE-2022-28199: NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled↗2022-09-01
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: Third Party (Dpdk) — CVE-2022-28199↗2023-04-15
▶
Cisco
Vulnerability in NVIDIA Data Plane Development Kit Affecting Cisco Products: August 2022↗2022-09-07
▶
Red Hat
dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service↗2022-08-30
▶
Debian
CVE-2022-28199: dpdk - NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a v...↗2022
▶