Every CVE Search/ Get API key

CVE-2022-0669

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected...

6.5 MediumFix available

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.30%Down 0.6 points since Aug 30, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
CVE-2022-0669
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
CVE-2022-0669
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2022-15758 No score

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
EUVD-2022-15758
Updated
2026-11-03
GitHub AdvisoriesGHSA-4vw6-hh56-rxvj 6.5

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected...

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
GHSA-4vw6-hh56-rxvj
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-0669 6.5

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
DEBIAN-CVE-2022-0669
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-03
OSVOESA-2022-1713 6.5

dpdk security update

DPDK core includes kernel modules, core libraries and tools. testpmd application allows to test fast packet processing environments on arm64 platforms. For instance, it can be used to check that environment can support fast path applications such as 6WINDGate, pktgen, rumptcpip, etc. More libraries are available as extensions in other packages.

Security Fix(es):

It’s an issue in the handling of vhost-user inflight type messages. A malicious vhost-user master can attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master could exhaust available fd in the vhost-user slave process and lead to a DoS.(CVE-2022-0669)

In DPDK Vhost communication, we didn’t test if msg->payload.inflight.num_queues is out of bounds in function ‘vhost_user_set_inflight_fd()’, and could cause the program to write OOB.(CVE-2021-3839)

Record
OESA-2022-1713
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2022:4786 7.5

Red Hat Security Advisory: openvswitch2.13 security update

Record
RHSA-2022:4786
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:4787 7.5

Red Hat Security Advisory: openvswitch2.15 security update

Record
RHSA-2022:4787
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:4788 7.5

Red Hat Security Advisory: openvswitch2.16 security update

Record
RHSA-2022:4788
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-0669 6.5

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
UBUNTU-CVE-2022-0669
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSV No score

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

Record
CVE-2022-0669
Weakness
CWE-400
Updated
2026-11-02
OSVopenSUSE-SU-2024:12039-1 No score

dpdk-21.11.1-2.1 on GA media

These are all security issues fixed in the dpdk-21.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12039-1
Updated
2026-11-02
OSVSUSE-SU-2022:1892-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

Security:

  • CVE-2021-3839: Fixed a memory corruption issue during vhost-user communication (bsc#1198963).
  • CVE-2022-0669: Fixed a denial of service that could be triggered by a vhost-user master (bsc#1198964).

Bugfixes:

  • kni: allow configuring thread granularity (bsc#1195172).
  • Fixed reading of PCI device name as UTF strings (bsc#1198873).
Record
SUSE-SU-2022:1892-1
Updated
2026-11-02
OSVSUSE-SU-2022:2273-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

  • CVE-2021-3839: Fixed a memory corruption issue during vhost-user communication (bsc#1198963).

  • CVE-2022-0669: Fixed a denial of service that could be triggered by a vhost-user master (bsc#1198964).

  • rebuild with new secure boot key due to grub2 boothole 3 issues (bsc#1198581)

Record
SUSE-SU-2022:2273-1
Updated
2026-11-02
OSVUSN-5401-1 No score

dpdk vulnerabilities

Wenxiang Qian discovered that DPDK incorrectly checked certain payloads. An attacker could use this issue to cause DPDK to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3839)

It was discovered that DPDK incorrectly handled inflight type messages. An attacker could possibly use this issue to cause DPDK to consume resources, leading to a denial of service. (CVE-2022-0669)

Record
USN-5401-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dpdk
Debian:12
 before 20.11.5-1
20.11.5-1
dpdk
Debian:13
 before 20.11.5-1
20.11.5-1
dpdk
Debian:14
 before 20.11.5-1
20.11.5-1
dpdk
Debian:11
From an advisory covering 2 CVEs
 before 20.11.5-1~deb11u1, plus listed versions
20.11-720.11.1-120.11.1-220.11.1-320.11.1-4
Show 7 moreShow less
20.11.2-120.11.3-120.11.3-1~deb11u120.11.3-220.11.4-120.11.4-220.11.4-2~deb11u1
20.11.5-1~deb11u1
dpdk
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 19.11-17.oe1
19.11-17.oe1
dpdk
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 19.11-17.oe1
19.11-17.oe1
dpdk
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 21.11-11.oe2203
21.11-11.oe2203
openvswitch2.13
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:2.13.0-180.el8fdp
0:2.13.0-180.el8fdp
openvswitch2.15
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:2.15.0-99.el8fdp
0:2.15.0-99.el8fdp
openvswitch2.16
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:2.16.0-74.el8fdp
0:2.16.0-74.el8fdp
Show 23 moreShow less
Affected packages
PackageAffectedFixed
dpdk
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk-thunderx
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk-thunderx
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk-thunderx
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 19.11.4-150300.11.1
19.11.4-150300.11.1
dpdk
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk-thunderx
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk-thunderx
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk-thunderx
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Manager Proxy 4.1
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Manager Server 4.1
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
SUSE:Enterprise Storage 7
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk-thunderx
SUSE:Enterprise Storage 7
From an advisory covering 2 CVEs
 before 19.11.4-150200.3.17.1
19.11.4-150200.3.17.1
dpdk
Ubuntu:20.04:LTS
 before 19.11.12-0ubuntu0.20.04.1, plus listed versions
18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1
Show 10 moreShow less
19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.119.11.3-0ubuntu0.219.11.6-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.219.11.10-0ubuntu0.20.04.1
19.11.12-0ubuntu0.20.04.1
dpdk
Ubuntu:22.04:LTS
 before 21.11.1-0ubuntu0.3, plus listed versions
20.11.3-0ubuntu120.11.3-0ubuntu321.11-121.11-1build1
21.11.1-0ubuntu0.3
dpdk
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 19.11.12-0ubuntu0.20.04.1, plus listed versions
18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1
Show 10 moreShow less
19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.119.11.3-0ubuntu0.219.11.6-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.219.11.10-0ubuntu0.20.04.1
19.11.12-0ubuntu0.20.04.1
dpdk
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 21.11.1-0ubuntu0.3, plus listed versions
20.11.3-0ubuntu120.11.3-0ubuntu321.11-121.11-1build1
21.11.1-0ubuntu0.3

History

History
RecordedChangedSources
affected, factsOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0669 is a medium vulnerability (CVSS 6.5) in [unknown] Dpdk, published April 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in dpdk 20.11.5-1.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open