CVE-2020-14374

What it actually does

Flawed bounds checking in the copy_data function permits a buffer overflow, enabling an attacker running inside a virtual machine to write arbitrary data to any address within the vhost_crypto process.

Why it matters to the business

Attackers can read or alter sensitive data, disrupt service availability, and potentially take control of the virtualized networking application, leading to downtime and data breaches in environments relying on the affected library.

How an attack unfolds

An attacker with access to a guest virtual machine crafts malicious input that triggers the vulnerable copy_data function, bypassing bounds checks to overflow a buffer and inject arbitrary data into the host-side vhost_crypto application memory space.

How to fix it

Upgrade DPDK to version 18.11.10 or later, or 19.11.5 or later. For listed Apache Ant packages apply the corresponding fixes: 1.10.11-1 on Debian 12/13, commit ea698c4543e319b05761a0fcba0c7e9f6cae3b96 in GIT, or Maven releases 1.10.11 and 1.9.16.

How to confirm the fix worked

Confirm the installed DPDK version meets or exceeds 18.11.10 or 19.11.5; review build logs and package manifests to verify the patched copy_data implementation is present; re-test virtual machine to host communication paths under load.

Typical attack path

1. Obtain code execution or shell access inside a guest virtual machine that communicates with the vulnerable DPDK vhost_crypto component
2. Trigger the copy_data function with specially crafted oversized or malformed data
3. Exploit the missing bounds check to perform an out-of-bounds write to arbitrary host memory addresses
4. Achieve data confidentiality or integrity violations or cause denial of service against the vhost_crypto process

How to detect it

Review hypervisor and guest logs for anomalous memory access patterns or crashes in vhost_crypto processes; examine network traffic between guests and the host DPDK application for unexpected large or malformed payloads around the time of any service instability.

What your security team should do

• Immediately inventory all systems using DPDK vhost_crypto and schedule upgrades to the fixed releases
• Apply the updates within normal change windows given the low EPSS and absence from KEV
• Monitor vendor advisories for any future changes in exploit maturity or EPSS trend