From 3645e3b781be5cedbb0e667caa70455444ce4552 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 18 Dec 2024 23:09:07 +0100 Subject: [PATCH] package/dpdk: security bump to version 24.11.1 Fixes the following security issue: CVE-2024-11614: An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using a virtio driver to cause the vhost-user side to crash by sending a packet with a Tx checksum offload request and an invalid csum_start offset. https://www.openwall.com/lists/oss-security/2024/12/17/3 Release notes: http://doc.dpdk.org/guides-24.11/rel_notes/release_24_11.html Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/dpdk/dpdk.hash | 2 +- package/dpdk/dpdk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/dpdk/dpdk.hash b/package/dpdk/dpdk.hash index 27c06476e7f7..e9a22736b0b2 100644 --- a/package/dpdk/dpdk.hash +++ b/package/dpdk/dpdk.hash @@ -1,5 +1,5 @@ # Locally computed -sha256 9944f7e5f268e7ac9b4193e2cd54ef6d98f6e1d7dddc967c77ae4f6616d6fbbd dpdk-24.07.tar.xz +sha256 bcae7d42c449fc456dfb279feabcbe0599a29bebb2fe2905761e187339d96b8e dpdk-24.11.1.tar.xz sha256 9acc4bc871a4742550158e3696dcb381953172ef808d04ca248184f9f6322712 license/bsd-3-clause.txt sha256 e19808bccd90c238fac06da2fc3683e094c64f7ba647e9d86f03a98cf5f2ce05 license/exceptions.txt sha256 6c54c4d44faf3cba829b3d0c21c6955953e758767018fd7244f809b01d4f4845 license/mit.txt diff --git a/package/dpdk/dpdk.mk b/package/dpdk/dpdk.mk index 2200f5fa00b1..0cbdc67e872a 100644 --- a/package/dpdk/dpdk.mk +++ b/package/dpdk/dpdk.mk @@ -4,7 +4,7 @@ # ################################################################################ -DPDK_VERSION = 24.07 +DPDK_VERSION = 24.11.1 DPDK_SOURCE = dpdk-$(DPDK_VERSION).tar.xz DPDK_SITE = https://fast.dpdk.org/rel DPDK_LICENSE = \