Skip to content
Fencer Intel
high 8.6

CVE-2022-2132 json

A permissive list of allowed inputs flaw was found in DPDK.

published 4y ago modified 4mo ago also EUVD-2022-34417

cvss
8.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

Patch / fix

  • dpdk data_plane_development_kit 19.11, 20.11, 21.11
  • dpdk Debian 14, Debian 13, Debian 12 22.11.1-2

debian advisories DEBIAN-CVE-2022-2132

  • dpdk Ubuntu 18.04 LTS 17.11.10-0ubuntu0.2
  • dpdk Ubuntu 20.04 LTS 19.11.13-0ubuntu0.20.04.1
  • dpdk Ubuntu 22.04 LTS 21.11.2-0ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2022-2132

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.5.2-202209140405_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.2-202209140405_8.6
  • dpdk RHEL 7 EXTRAS_OTHER 18.11.8-2.el7_9
  • dpdk-tools RHEL 7 EXTRAS_OTHER 18.11.8-2.el7_9
  • dpdk RHEL 8 21.11-2.el8_7
  • dpdk-tools RHEL 8 21.11-2.el8_7
  • dpdk RHEL 9 2:21.11.2-1.el9_1
  • dpdk-tools RHEL 9 2:21.11.2-1.el9_1

red hat advisories RHSA-2022:6551RHSA-2023:0168RHSA-2023:0167RHSA-2023:0170RHSA-2023:0166RHSA-2023:0169

  • dpdk SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 19.11.10-150400.4.12.1
  • dpdk-thunderx SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 19.11.10-150400.4.12.1
  • dpdk SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 18.11.9-3.29.1
  • dpdk-thunderx SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 18.11.9-3.29.1
  • dpdk SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 19.11.4-150300.21.1
  • dpdk-thunderx SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS, Enterprise Storage 7.1 19.11.4-150300.21.1
  • dpdk SLE Module for Legacy 15 SP5, openSUSE Leap 15.5 19.11.10-150500.5.3.1
  • dpdk-thunderx SLE Module for Legacy 15 SP5, openSUSE Leap 15.5 19.11.10-150500.5.3.1

suse advisories SUSE-SU-2024:0576-1SUSE-SU-2024:0554-1SUSE-SU-2024:0531-1SUSE-SU-2024:0530-1SUSE-SU-2024:0529-1SUSE-SU-2022:3430-1

  • dpdk AlmaLinux 8 21.11-2.el8_7
  • dpdk-tools AlmaLinux 8 21.11-2.el8_7
  • dpdk AlmaLinux 9 2:21.11.2-1.el9_1
  • dpdk-tools AlmaLinux 9 2:21.11.2-1.el9_1

almalinux advisories ALSA-2023:0171ALSA-2022:8263

  • dpdk Rocky Linux 8 21.11-2.el8_7
  • dpdk Rocky Linux 9 2:21.11.2-1.el9_1

rocky linux advisories RLSA-2023:0171RLSA-2022:8263

Is CVE-2022-2132 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2132 updated cvss 8.6

dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs

  • Red Hat Fast Datapath for RHEL 7 openvswitch2.12, openvswitch2.12-test, python-openvswitch2.12 Red Hat Fast Datapath for RHEL 8 openvswitch2.12, openvswitch2.12-test, python3-openvswitch2.12, network-scripts-openvswitch2.12
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 openvswitch2.13, openvswitch2.15, openvswitch2.16, openvswitch2.13-test, openvswitch2.15-test, openvswitch2.16-test, +8 more
    affected: no fix planned “Will not fix”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.11 2.11.3-96.2.el7fdp, openvswitch2.11-test 2.11.3-96.2.el7fdp, python-openvswitch2.11 2.11.3-96.2.el7fdp
    fixed: vendor fix RHSA-2022:6850
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.16 2.16.0-89.2.el8fdp, openvswitch2.17 2.17.0-37.3.el8fdp, openvswitch2.13 2.13.0-193.2.el8fdp, openvswitch2.15 2.15.0-113.2.el8fdp, openvswitch2.16-test 2.16.0-89.2.el8fdp, openvswitch2.17-test 2.17.0-37.3.el8fdp, +14 more
    fixed: vendor fix RHSA-2022:6384
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 openvswitch2.17 2.17.0-32.3.el9fdp, openvswitch2.17-test 2.17.0-32.3.el9fdp, openvswitch2.17-ipsec 2.17.0-32.3.el9fdp, python3-openvswitch2.17 2.17.0-32.3.el9fdp
    fixed: vendor fix RHSA-2022:6386
  • Red Hat Enterprise Linux 7 Extras dpdk 18.11.8-2.el7_9, dpdk-tools 18.11.8-2.el7_9
    fixed: vendor fix RHSA-2023:0167
  • Red Hat Enterprise Linux AppStream (v. 8) dpdk 21.11-2.el8_7, dpdk-tools 21.11-2.el8_7
    fixed: vendor fix RHSA-2023:0171
  • Red Hat Enterprise Linux AppStream (v. 9) dpdk 21.11.2-1.el9_1, dpdk-tools 21.11.2-1.el9_1
    fixed: vendor fix RHSA-2022:8263
show 10 more
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) dpdk 19.11-6.el8_2, dpdk-tools 19.11-6.el8_2
    fixed: vendor fix RHSA-2023:0166
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) dpdk 18.11.2-5.el8_1, dpdk-tools 18.11.2-5.el8_1
    fixed: vendor fix RHSA-2023:0168
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) dpdk 19.11-6.el8_2, dpdk-tools 19.11-6.el8_2
    fixed: vendor fix RHSA-2023:0166
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) dpdk 20.11-4.el8_4, dpdk-tools 20.11-4.el8_4
    fixed: vendor fix RHSA-2023:0169
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) dpdk 21.11-2.el8_6, dpdk-tools 21.11-2.el8_6
    fixed: vendor fix RHSA-2023:0170
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) dpdk 21.11-2.el9_0, dpdk-tools 21.11-2.el9_0
    fixed: vendor fix RHSA-2023:0172
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) dpdk 19.11-6.el8_2, dpdk-tools 19.11-6.el8_2
    fixed: vendor fix RHSA-2023:0166
  • Red Hat OpenStack Platform 13.0 - ELS openvswitch2.11 2.11.3-96.2.el7fdp, openvswitch2.11-test 2.11.3-96.2.el7fdp, python-openvswitch2.11 2.11.3-96.2.el7fdp
    fixed: vendor fix RHSA-2022:7268
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.5.2-202209140405_8.6, redhat-virtualization-host-image-update 4.5.2-202209140405_8.6
    fixed: vendor fix RHSA-2022:6551
  • Red Hat Fast Datapath for RHEL 7 openvswitch, openvswitch2.10, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, +9 more Red Hat Ceph Storage 3 ceph, librbd1, librgw2, ceph-mds, ceph-mgr, ceph-mon, +15 more Red Hat Ceph Storage 4 ceph, librbd1, librgw2, rbd-nbd, ceph-mds, ceph-mgr, +27 more Red Hat OpenStack Platform 13 (Queens) rhosp-openvswitch, rhosp-openvswitch-test, python-rhosp-openvswitch, rhosp-openvswitch-ovn-host, rhosp-openvswitch-ovn-vtep, rhosp-openvswitch-ovn-common, +1 more Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.5.2-1.el8ev, redhat-virtualization-host-productimg 4.5.2-1.el8, redhat-release-virtualization-host-content 4.5.2-1.el8ev, redhat-virtualization-host-image-update-placeholder 4.5.2-1.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • bugs.dpdk.org https://bugs.dpdk.org/show_bug.cgi?id=1031 referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2099475 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

  • n/a dpdk

Classification

Weakness
  • CWE-791 Incomplete Filtering of Special Elements

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.