CVE-2020-10724: 
CBL Mariner vulnerability analysis and mitigation

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read (NVD, MITRE).

The vulnerability exists in the vhost crypto library code's post message handler (vhost_crypto_msg_post_handler) which calls vhost_crypto_create_sess() and subsequently transform_cipher_param() or transform_chain_param() depending on the operation type. The payload contains cipher key lengths and buffers (VHOST_USER_CRYPTO_MAX_CIPHER_KEY_LENGTH of 64 bytes) as well as digest length and authentication key buffers (VHOST_USER_CRYPTO_MAX_HMAC_KEY_LENGTH of 512 bytes), but none of these length values are validated, which can lead to out-of-bounds memory reads (OSS Security).

The missing input validation could allow an attacker to cause information leaks through out-of-bounds memory reads or potentially trigger crashes in the vhost-user backend application (NVD, OSS Security).

The vulnerability has a CVSS v3.1 base score of 5.1 (Medium) with vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H. The vulnerability requires local access and high privileges to exploit (OSS Security).

The vulnerability was fixed in DPDK versions 20.02.1, 19.11.2 (LTS), and 18.11.8 (LTS). Users are strongly encouraged to upgrade to these patched versions as soon as possible (OSS Security).