{"id":"CVE-2021-3839","details":"A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg-\u003epayload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.","modified":"2026-02-24T01:22:29.504076Z","published":"2022-08-23T16:15:10.087Z","related":["ALSA-2022:8263","SUSE-SU-2022:1892-1","SUSE-SU-2022:2273-1"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2021-3839"},{"type":"ADVISORY","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025882"},{"type":"ADVISORY","url":"https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025882"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025882"},{"type":"FIX","url":"https://github.com/DPDK/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dpdk/dpdk","events":[{"introduced":"0"},{"fixed":"6442c329b9d2ded0f44b27d2016aaba8ba5844c5"}]}],"versions":["v1.2.3r0","v1.3.0r0","v1.3.1r0","v1.4.0r0","v1.4.1r0","v1.5.0r0","v1.5.1r0","v1.5.2r0","v1.6.0r0","v1.6.0r1","v1.6.0r2","v1.7.0","v1.7.0-rc1","v1.7.0-rc2","v1.7.0-rc3","v1.7.0-rc4","v1.7.1","v1.8.0","v1.8.0-rc1","v1.8.0-rc2","v1.8.0-rc3","v1.8.0-rc4","v1.8.0-rc5","v1.8.0-rc6","v16.04","v16.04-rc1","v16.04-rc2","v16.04-rc3","v16.04-rc4","v16.07","v16.07-rc1","v16.07-rc2","v16.07-rc3","v16.07-rc4","v16.07-rc5","v16.11","v16.11-rc1","v16.11-rc2","v16.11-rc3","v17.02","v17.02-rc1","v17.02-rc2","v17.02-rc3","v17.05","v17.05-rc1","v17.05-rc2","v17.05-rc3","v17.05-rc4","v17.08","v17.08-rc1","v17.08-rc2","v17.08-rc3","v17.08-rc4","v17.11","v17.11-rc1","v17.11-rc2","v17.11-rc3","v17.11-rc4","v18.02","v18.02-rc1","v18.02-rc2","v18.02-rc3","v18.02-rc4","v18.05","v18.05-rc1","v18.05-rc2","v18.05-rc3","v18.05-rc4","v18.05-rc5","v18.05-rc6","v18.08","v18.08-rc1","v18.08-rc2","v18.08-rc3","v18.11","v18.11-rc1","v18.11-rc2","v18.11-rc3","v18.11-rc4","v18.11-rc5","v19.02","v19.02-rc1","v19.02-rc2","v19.02-rc3","v19.02-rc4","v19.05","v19.05-rc1","v19.05-rc2","v19.05-rc3","v19.05-rc4","v19.08","v19.08-rc1","v19.08-rc2","v19.08-rc3","v19.08-rc4","v19.11","v19.11-rc1","v19.11-rc2","v19.11-rc3","v19.11-rc4","v2.0.0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.1.0","v2.1.0-rc1","v2.1.0-rc2","v2.1.0-rc3","v2.1.0-rc4","v2.2.0","v2.2.0-rc1","v2.2.0-rc2","v2.2.0-rc3","v2.2.0-rc4","v20.02","v20.02-rc1","v20.02-rc2","v20.02-rc3","v20.02-rc4","v20.05","v20.05-rc1","v20.05-rc2","v20.05-rc3","v20.05-rc4","v20.08","v20.08-rc1","v20.08-rc2","v20.08-rc3","v20.08-rc4","v20.11","v20.11-rc1","v20.11-rc2","v20.11-rc3","v20.11-rc4","v20.11-rc5","v21.02","v21.02-rc1","v21.02-rc2","v21.02-rc3","v21.02-rc4","v21.05","v21.05-rc1","v21.05-rc2","v21.05-rc3","v21.05-rc4","v21.08","v21.08-rc1","v21.08-rc2","v21.08-rc3","v21.08-rc4","v21.11","v21.11-rc1","v21.11-rc2","v21.11-rc3","v21.11-rc4","v22.03-rc1","v22.03-rc2","v22.03-rc3"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3839.json","vanir_signatures":[{"signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["218964855366889817698744017324434491215","153393868971813765081598737286992637585","215130104168108337750727703366659950908","135045007302257789395044528308605937321"]},"signature_version":"v1","id":"CVE-2021-3839-07035299","target":{"file":"lib/vhost/vhost_user.c"},"deprecated":false,"source":"https://github.com/dpdk/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"},{"signature_type":"Function","digest":{"length":789,"function_hash":"340127545324019451371334732147163230990"},"signature_version":"v1","id":"CVE-2021-3839-60bcf5ef","target":{"function":"vhost_user_check_and_alloc_queue_pair","file":"lib/vhost/vhost_user.c"},"deprecated":false,"source":"https://github.com/dpdk/dpdk/commit/6442c329b9d2ded0f44b27d2016aaba8ba5844c5"}]}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}