CVE-2024-11614

Vulnerability

The vulnerability (CVE-2024-11614) is an out-of-bounds read in DPDK's Vhost library, specifically within the checksum offload feature. The root cause is improper validation of a csum_start offset from untrusted Virtio descriptors. [1]

Exploitation

An attacker who controls a guest VM with a virtio driver can send a crafted packet that requests Tx checksum offload with an invalid csum_start offset. This triggers an out-of-bounds read in the vhost-user backend running in the hypervisor, bypassing any authentication beyond guest access. [2]

Impact

Successful exploitation causes the hypervisor's vSwitch process to crash, resulting in denial of service. The attacker can disrupt network connectivity for other VMs and potentially destabilize the host. No code execution or data leakage is indicated beyond the read itself. [3]

Mitigation

Red Hat has issued errata (RHSA-2025:0210, RHSA-2025:0209, RHSA-2025:0208, RHSA-2025:0220) to address this flaw. Users should update the affected DPDK packages to the fixed versions provided in those advisories. [4]