CVE-2024-11614

What it actually does

Out-of-bounds read in DPDK Vhost library checksum offload triggered by forged Virtio descriptors with invalid csum_start offset, allowing a guest VM to crash the hypervisor vSwitch.

Why it matters to the business

Denial of service against virtual network infrastructure that can take down connectivity for many VMs; low exploit likelihood and old publication reduce immediate urgency despite listed PHP package fixes.

How an attack unfolds

An attacker controlling a malicious VM using a virtio driver crafts a packet requesting Tx checksum offload with an invalid csum_start offset, causing the vhost-user side to perform an out-of-bounds read and crash.

How to fix it

Upgrade affected packages to the listed fixed versions: php5 (Ubuntu:14.04:LTS) to 5.5.9+dfsg-1ubuntu4.17 and php7.0 (Ubuntu:16.04:LTS) to 7.0.4-7ubuntu2.1; apply hypervisor and DPDK updates where Vhost is in use.

How to confirm the fix worked

Confirm package versions match the fixed releases, test that malicious checksum-offload packets no longer crash vSwitch, and review Virtio descriptor handling in updated DPDK builds.

Typical attack path

1. Gain control of a VM with virtio networking
2. Forge Virtio descriptors containing invalid checksum offset
3. Transmit packet that requests checksum offload
4. Trigger vhost-user crash on the hypervisor

How to detect it

Inspect hypervisor and vSwitch logs for abrupt crashes or OOB read errors around checksum offload handling; correlate with guest VM network activity.

What your security team should do

• Prioritize upgrade of listed Ubuntu PHP packages and any DPDK/Vhost components
• Monitor for vSwitch crashes correlated with guest network traffic
• Review virtualization isolation controls for untrusted VMs