CVE-2024-11614: 
Rocky Linux vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2024-11614) was discovered in DPDK's Vhost library checksum offload feature. The vulnerability was introduced in DPDK v21.05 and affects systems where Vhost-based applications register devices with the RTEVHOSTUSERNETCOMPLIANTOLFLAGS flag (Bugzilla, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.0 base score of 7.4 (HIGH). The issue occurs when processing packets with Tx checksum offload requests containing invalid csum_start offsets. The vulnerability specifically affects the checksum offload feature in the DPDK Vhost library when handling Virtio descriptors (NVD, Red Hat).

This vulnerability enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. The impact is limited to denial of service, with no evidence of data confidentiality or integrity breaches (Openwall).

Multiple vendors have released security updates to address this vulnerability. Red Hat has released fixes across various versions of Red Hat Enterprise Linux, including versions 8.x and 9.x. The fixes are available through security advisories RHSA-2025:0208 through RHSA-2025:0222. Debian has also released fixes for affected versions, with version 24.11.1-1 addressing the vulnerability in the unstable branch (Red Hat, Debian).