CVE-2020-10726: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-10726 affects DPDK versions 19.11 and above. The vulnerability was discovered in March 2020 and disclosed in May 2020. The affected component is the librte_vhost module in DPDK (Data Plane Development Kit) (DPDK Bug, NVD).

The vulnerability exists in the vhost-user socket handling where a malicious container with direct access to the vhost-user socket can continuously send VHOST_USER_GET_INFLIGHT_FD messages. This causes resource leaks in both file descriptors and virtual memory. The vulnerability has a CVSS v3.1 Base Score of 4.4 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (NVD).

A successful exploitation of this vulnerability can result in a denial of service condition by exhausting system resources through continuous leakage of file descriptors and virtual memory (DPDK Bug).

The vulnerability requires local access and high privileges to exploit. The attacker needs direct access to the vhost-user socket to send malicious messages. The attack complexity is considered low as it involves repeatedly sending specific messages (NVD).

The vulnerability was fixed in DPDK versions 20.02.1 and 19.11.2. Users are strongly recommended to upgrade to these or later versions. The fixes include patches to prevent resource leaks from VHOST_USER_GET_INFLIGHT_FD message flooding (OpenWall).