CVE-2020-10723: 
CBL Mariner vulnerability analysis and mitigation

CVE-2020-10723 affects DPDK (Data Plane Development Kit) versions 17.05 and above. The vulnerability was discovered in March 2020 and publicly disclosed in May 2020. The issue exists in the librte_vhost component where an integer truncation occurs on the index of a payload (DPDK Bug, NVD).

The vulnerability stems from an integer truncation issue in the vhost_user_check_and_alloc_queue_pair() function. When extracting a vring index from a payload, the index (a UInt) is copied and truncated into a uint16, which results in the top 16 bits of the index never being validated. The CVSS v3.1 base score is 6.7 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

When the truncated index is used later in functions like vhost_user_set_vring_num() or vhost_user_set_vring_addr(), it can lead to out of bound indexing. This results in memory corruption as the out-of-bounds indexed data gets written to (OpenWall).

The vulnerability requires local access and high privileges to exploit. While the attack complexity is low, it requires no user interaction to execute. The vulnerability has been assigned a CVSS v3.1 base score of 6.7, indicating medium severity (NVD).

The issue has been patched in multiple DPDK versions: 20.02.1, 19.11.2 (LTS), and 18.11.8 (LTS). Users are strongly encouraged to upgrade to these patched versions. The fixes have been incorporated into various distributions including Red Hat Enterprise Linux, Ubuntu, and OpenSUSE (OpenWall, Ubuntu Notice).