CVE-2022-2132: A permissive list of allowed inputs flaw was found in DPDK

This week

HIGH 8.6REMOTEWATCHLISTUPGRADEMITIGATEMITIGATE

CVE-2022-2132 is a high-severity flaw (CVSS 8.6) affecting data plane development kit, fedora, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.6 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	2.4% (top 16%)
CISA exploited list	No
Weakness	CWE-791
Published	2022-08-31
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: debian · dpdk · fedoraproject · redhat

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-08-31 16:15 UTCPublished CVE record published
2026-06-17 04:41 UTCUpdated Record last modified

dpdk data plane development kit UPGRADE

Affected: < 19.11 · >= 20.0 and < 20.11 · >= 21.0 and < 21.11

Fixed in: 19.11, 20.11, 21.11

Safe to downgrade to: a release before 20.0

1. Check installed version

apt-cache policy data-plane-development-kit || rpm -q data-plane-development-kit || data-plane-development-kit --version

2. UPGRADE to 19.11 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade data-plane-development-kit

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade data-plane-development-kit

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 20.0 (Debian / Ubuntu)

apt-cache madison data-plane-development-kit sudo apt install data-plane-development-kit=<VERSION_BEFORE_20.0> sudo apt-mark hold data-plane-development-kit

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list data-plane-development-kit sudo dnf downgrade data-plane-development-kit-<VERSION_BEFORE_20.0> sudo dnf versionlock add data-plane-development-kit

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

fedoraproject fedora MITIGATE

Affected: 36

Fixed in: no fixed release known

Safe to downgrade to: a release before 36

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

debian debian linux MITIGATE

Affected: 10.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

redhat enterprise linux fast datapath DOWNGRADE

Affected: 7.0 · 8.0 · 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0

1. Check installed version

apt-cache policy enterprise-linux-fast-datapath || rpm -q enterprise-linux-fast-datapath || enterprise-linux-fast-datapath --version

2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)

apt-cache madison enterprise-linux-fast-datapath sudo apt install enterprise-linux-fast-datapath=<VERSION_BEFORE_7.0> sudo apt-mark hold enterprise-linux-fast-datapath

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list enterprise-linux-fast-datapath sudo dnf downgrade enterprise-linux-fast-datapath-<VERSION_BEFORE_7.0> sudo dnf versionlock add enterprise-linux-fast-datapath

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat openshift container platform DOWNGRADE

Affected: 4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.0

1. Check installed version

apt-cache policy openshift-container-platform || rpm -q openshift-container-platform || openshift-container-platform --version

2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)

apt-cache madison openshift-container-platform sudo apt install openshift-container-platform=<VERSION_BEFORE_4.0> sudo apt-mark hold openshift-container-platform

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list openshift-container-platform sudo dnf downgrade openshift-container-platform-<VERSION_BEFORE_4.0> sudo dnf versionlock add openshift-container-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat openstack platform DOWNGRADE

Affected: 13.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 13.0

1. Check installed version

apt-cache policy openstack-platform || rpm -q openstack-platform || openstack-platform --version

2. No fixed release: DOWNGRADE to a release before 13.0 (Debian / Ubuntu)

apt-cache madison openstack-platform sudo apt install openstack-platform=<VERSION_BEFORE_13.0> sudo apt-mark hold openstack-platform

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list openstack-platform sudo dnf downgrade openstack-platform-<VERSION_BEFORE_13.0> sudo dnf versionlock add openstack-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-2132?

data plane development kit: upgrade to 19.11, 20.11, 21.11; fedora: mitigate or apply the listed mitigation; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2022-2132 being exploited?

CVE-2022-2132 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-2132 affect?

CVE-2022-2132 affects data plane development kit, fedora, debian linux. Severity is high (CVSS 8.6). A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

How urgent is CVE-2022-2132?

Priority 66/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Debian vulnerabilities · Red Hat OpenShift vulnerabilities · OpenStack vulnerabilities

Related CVEs

CVE-2022-28199 MEDIUM 6.5 UPGRADE NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network st
CVE-2022-0669 MEDIUM 6.5 UPGRADE DOWNGRADE A flaw was found in dpdk
CVE-2021-3839 HIGH 7.5 UPGRADE MITIGATE A flaw was found in the vhost library in DPDK
CVE-2020-14378 LOW 3.3 UPGRADE MITIGATE An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead
CVE-2020-14377 HIGH 7.1 UPGRADE MITIGATE A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5

References

← Back to latest CVEs