CVE-2019-14818 — dpdk: possible memory leak leads to denial of service

Back Back to CVE browser

HIGH

dpdk: possible memory leak leads to denial of service

Published Nov 14, 2019

7.5

HIGH

CVSS 3.1

EPSS 2.81%

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

Affected products

Vendor DPDK Product Dpdk Default
n/a
- Version
  all dpdk version 16.x.x before 16.11.10
  Status
  affected
  Constraints
  -
- Version
  all dpdk version 17.x.x before 17.11.8
  Status
  affected
  Constraints
  -
- Version
  all dpdk version 18.x.x before 18.11.4
  Status
  affected
  Constraints
  -
- Version
  all dpdk version 19.x.x before 19.08.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

DPDK

Dpdk

n/a

Version	Status	Constraints
all dpdk version 16.x.x before 16.11.10	affected	-
all dpdk version 17.x.x before 17.11.8	affected	-
all dpdk version 18.x.x before 18.11.4	affected	-
all dpdk version 19.x.x before 19.08.1	affected	-

Fast Datapath for Red Hat Enterprise Linux 7

openvswitch-0:2.9.0-124.el7fdp

Fixed · RHSA-2020:0165
Fast Datapath for Red Hat Enterprise Linux 7

openvswitch2.11-0:2.11.0-35.el7fdp

Fixed · RHSA-2020:0166
Fast Datapath for Red Hat Enterprise Linux 7

openvswitch2.12-0:2.12.0-12.el7fdp

Fixed · RHSA-2020:0168
Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.11-0:2.11.0-35.el8fdp

Fixed · RHSA-2020:0171
Fast Datapath for Red Hat Enterprise Linux 8

openvswitch2.12-0:2.12.0-12.el8fdp

Fixed · RHSA-2020:0172
Red Hat Enterprise Linux 7 Extras

dpdk-0:18.11.5-1.el7_8

Fixed · RHSA-2020:1226
Red Hat Enterprise Linux 8

dpdk-0:19.11-4.el8

Fixed · RHSA-2020:1735
Red Hat OpenStack Platform 13.0 (Queens)

ansible-role-redhat-subscription-0:1.0.4-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

openstack-manila-1:6.3.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

openstack-octavia-ui-0:1.0.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

openstack-tempest-1:18.0.0-13.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

openvswitch2.11-0:2.11.0-35.el7fdp

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-barbican-tests-tempest-0:0.1.0-0.20180828144800.b8bf147.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-hardware-0:0.23.0-0.20200117070144.59211cc.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-keystoneauth1-0:3.4.1-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-keystonemiddleware-0:4.22.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-neutron-lib-0:1.13.0-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-novajoin-0:1.3.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-octavia-tests-tempest-0:1.1.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-openstackclient-0:3.14.3-5.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-openstacksdk-0:0.11.4-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-os-testr-0:1.0.1-0.20200218144109.7dd678e.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-os-vif-0:1.9.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-ovsdbapp-0:0.10.4-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

python-tempestconf-0:2.4.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

rabbitmq-server-0:3.6.15-6.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)

rhosp-release-0:13.0.11-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

ansible-role-redhat-subscription-0:1.0.4-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

openstack-manila-1:6.3.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

openstack-octavia-ui-0:1.0.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

openstack-tempest-1:18.0.0-13.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-barbican-tests-tempest-0:0.1.0-0.20180828144800.b8bf147.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-hardware-0:0.23.0-0.20200117070144.59211cc.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-keystoneauth1-0:3.4.1-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-keystonemiddleware-0:4.22.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-neutron-lib-0:1.13.0-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-novajoin-0:1.3.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-octavia-tests-tempest-0:1.1.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-openstackclient-0:3.14.3-5.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-openstacksdk-0:0.11.4-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-os-testr-0:1.0.1-0.20200218144109.7dd678e.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-os-vif-0:1.9.2-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-ovsdbapp-0:0.10.4-2.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

python-tempestconf-0:2.4.0-1.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

rabbitmq-server-0:3.6.15-6.el7ost

Fixed · RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

rhosp-release-0:13.0.11-1.el7ost

Fixed · RHBA-2020:0769
Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS

openvswitch-0:2.9.0-124.el7fdp

Fixed · RHSA-2020:0165
Fast Datapath for RHEL 7

openvswitch2.10

Will not fix
Fast Datapath for RHEL 8

openvswitch

Not affected
Fast Datapath for RHEL 8

openvswitch2.10

Not affected
Red Hat Ceph Storage 3

ceph

Not affected
Red Hat Ceph Storage 4

ceph

Will not fix
Red Hat OpenStack Platform 10 (Newton)

dpdk

Not affected
Red Hat OpenStack Platform 10 (Newton)

openvswitch

Out of support scope
Red Hat OpenStack Platform 14 (Rocky)

openvswitch

Out of support scope

Product	Package	State	Advisory
Fast Datapath for Red Hat Enterprise Linux 7	openvswitch-0:2.9.0-124.el7fdp	Fixed	RHSA-2020:0165
Fast Datapath for Red Hat Enterprise Linux 7	openvswitch2.11-0:2.11.0-35.el7fdp	Fixed	RHSA-2020:0166
Fast Datapath for Red Hat Enterprise Linux 7	openvswitch2.12-0:2.12.0-12.el7fdp	Fixed	RHSA-2020:0168
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.11-0:2.11.0-35.el8fdp	Fixed	RHSA-2020:0171
Fast Datapath for Red Hat Enterprise Linux 8	openvswitch2.12-0:2.12.0-12.el8fdp	Fixed	RHSA-2020:0172
Red Hat Enterprise Linux 7 Extras	dpdk-0:18.11.5-1.el7_8	Fixed	RHSA-2020:1226
Red Hat Enterprise Linux 8	dpdk-0:19.11-4.el8	Fixed	RHSA-2020:1735
Red Hat OpenStack Platform 13.0 (Queens)	ansible-role-redhat-subscription-0:1.0.4-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	openstack-manila-1:6.3.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	openstack-octavia-ui-0:1.0.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	openstack-tempest-1:18.0.0-13.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	openvswitch2.11-0:2.11.0-35.el7fdp	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-barbican-tests-tempest-0:0.1.0-0.20180828144800.b8bf147.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-hardware-0:0.23.0-0.20200117070144.59211cc.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-keystoneauth1-0:3.4.1-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-keystonemiddleware-0:4.22.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-neutron-lib-0:1.13.0-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-novajoin-0:1.3.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-octavia-tests-tempest-0:1.1.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-openstackclient-0:3.14.3-5.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-openstacksdk-0:0.11.4-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-os-testr-0:1.0.1-0.20200218144109.7dd678e.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-os-vif-0:1.9.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-ovsdbapp-0:0.10.4-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	python-tempestconf-0:2.4.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	rabbitmq-server-0:3.6.15-6.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens)	rhosp-release-0:13.0.11-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	ansible-role-redhat-subscription-0:1.0.4-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	openstack-manila-1:6.3.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	openstack-octavia-ui-0:1.0.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	openstack-tempest-1:18.0.0-13.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-barbican-tests-tempest-0:0.1.0-0.20180828144800.b8bf147.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-hardware-0:0.23.0-0.20200117070144.59211cc.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-keystoneauth1-0:3.4.1-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-keystonemiddleware-0:4.22.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-neutron-lib-0:1.13.0-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-novajoin-0:1.3.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-octavia-tests-tempest-0:1.1.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-openstackclient-0:3.14.3-5.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-openstacksdk-0:0.11.4-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-os-testr-0:1.0.1-0.20200218144109.7dd678e.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-os-vif-0:1.9.2-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-ovsdbapp-0:0.10.4-2.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	python-tempestconf-0:2.4.0-1.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	rabbitmq-server-0:3.6.15-6.el7ost	Fixed	RHBA-2020:0769
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS	rhosp-release-0:13.0.11-1.el7ost	Fixed	RHBA-2020:0769
Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS	openvswitch-0:2.9.0-124.el7fdp	Fixed	RHSA-2020:0165
Fast Datapath for RHEL 7	openvswitch2.10	Will not fix	n/a
Fast Datapath for RHEL 8	openvswitch	Not affected	n/a
Fast Datapath for RHEL 8	openvswitch2.10	Not affected	n/a
Red Hat Ceph Storage 3	ceph	Not affected	n/a
Red Hat Ceph Storage 4	ceph	Will not fix	n/a
Red Hat OpenStack Platform 10 (Newton)	dpdk	Not affected	n/a
Red Hat OpenStack Platform 10 (Newton)	openvswitch	Out of support scope	n/a
Red Hat OpenStack Platform 14 (Rocky)	openvswitch	Out of support scope	n/a

Remediation

Red Hat statement

The dpdk package within Red Hat OpenStack Platform 10 has been superseded by the version included with RHEL Extras, fixes for dpdk will be consumed from here.

Metrics

2.81% 0.02815

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02815

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (21 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.81% (0.02815)	86.06th	v5 (v2026.06.15)
Jun 15, 2026	2.76% (0.02761)	84.30th	v5 (v2026.06.15)
Nov 21, 2025	1.14% (0.01137)	77.76th	v4 (v2025.03.14)
Nov 18, 2025	2.42% (0.02415)	83.77th	v4 (v2025.03.14)
Mar 30, 2025	1.07% (0.01074)	75.78th	v4 (v2025.03.14)
Mar 29, 2025	2.73% (0.02728)	76.55th	v4 (v2025.03.14)
Mar 17, 2025	0.57% (0.00568)	66.59th	v4 (v2025.03.14)
Dec 12, 2024	0.99% (0.00988)	84.17th	v3 (v2023.03.01)
Mar 30, 2024	0.61% (0.00610)	78.23th	v3 (v2023.03.01)
Nov 8, 2023	0.61% (0.00610)	76.22th	v3 (v2023.03.01)
Oct 21, 2023	0.62% (0.00619)	76.44th	v3 (v2023.03.01)
Oct 5, 2023	0.54% (0.00542)	74.62th	v3 (v2023.03.01)
Sep 18, 2023	0.56% (0.00565)	75.06th	v3 (v2023.03.01)
Mar 7, 2023	0.58% (0.00582)	74.76th	v3 (v2023.03.01)
Mar 6, 2023	1.18% (0.01183)	61.76th	v2 (v2022.01.01)
Apr 1, 2022	1.18% (0.01183)	58.77th	v2 (v2022.01.01)
Feb 4, 2022	19.17% (0.19173)	93.71th	v2 (v2022.01.01)
Feb 3, 2022	9.61% (0.09608)	87.22th	v1
Jan 6, 2022	9.61% (0.09608)	87.07th	v1
Jan 5, 2022	2.31% (0.02314)	78.93th	v5 (v2026.06.15)
Apr 14, 2021	2.31% (0.02314)	0.00th	v1

Weaknesses (1)

CWE-401

References (12)

https://access.redhat.com/errata/RHSA-2020:0165
vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0166
vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0168
vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0171
vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0172
vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-14818
Vendor Advisory
https://bugs.dpdk.org/show_bug.cgi?id=363
Issue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1737327
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
Issue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14818
https://www.cve.org/CVERecord?id=CVE-2019-14818

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2020:0165		vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0166		vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0168		vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0171		vendor-advisoryThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0172		vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-14818		Vendor Advisory
https://bugs.dpdk.org/show_bug.cgi?id=363		Issue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1737327		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818		Issue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14818
https://www.cve.org/CVERecord?id=CVE-2019-14818

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Nov 14, 2019

Updated Aug 5, 2024

Reserved Aug 10, 2019

Link CVE-2019-14818

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-14818

Red Hat

Severity Moderate

Public date Nov 12, 2019

Links CVE-2019-14818 - Bugzilla