CVE-2024-11614

{"id": "CVE-2024-11614", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "published": "2024-12-18T09:15:06.660", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:0208", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0209", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0210", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0211", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0220", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0221", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:0222", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-11614", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327955", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2024/12/17/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de lectura fuera de los l\u00edmites en la funci\u00f3n de descarga de suma de comprobaci\u00f3n de la librer\u00eda DPDK's Vhost. Este problema permite que un invitado no confiable o comprometido bloquee el vSwitch del hipervisor falsificando descriptores Virtio para provocar lecturas fuera de los l\u00edmites. Esta falla permite que un atacante con una m\u00e1quina virtual maliciosa que utilice un controlador Virtio haga que el lado del usuario vhost se bloquee enviando un paquete con una solicitud de descarga de suma de comprobaci\u00f3n Tx y un desplazamiento csum_start no v\u00e1lido."}], "lastModified": "2025-01-09T19:15:17.283", "sourceIdentifier": "secalert@redhat.com"}