Backport dpdk as MRE for bionic, focal, impish, jammy (September)

[Bryce Harrington]

Backport dpdk as MRE for bionic, focal, impish, jammy

[Christian Ehrhardt  (paelzer)]

There is no new version for 17.11.x anymore - so Bionic is up to the security team to consider for https://ubuntu.com/security/CVE-2022-2132

The work on the rest is started

[Christian Ehrhardt  (paelzer)]

CVE references: https://bugs.dpdk.org/show_bug.cgi?id=1031

Upstream released 21.11.2 and 19.11.13 which we will prepare as updates for F/J/K

[Christian Ehrhardt  (paelzer)]

Started a PPA for build and tests => https://launchpad.net/~paelzer/+archive/ubuntu/lp-1975764-dpdk-mre-sept-2022
MPs:
- F: https://code.launchpad.net/~paelzer/ubuntu/+source/dpdk/+git/dpdk/+merge/429621
- J: https://code.launchpad.net/~paelzer/ubuntu/+source/dpdk/+git/dpdk/+merge/429622
- K: https://code.launchpad.net/~paelzer/ubuntu/+source/dpdk/+git/dpdk/+merge/429623

[Christian Ehrhardt  (paelzer)]

Security backport for Bionic (17.11) is in https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa (thanks leosilvab).
I'll try to test that as well, but these things take a while ...

So far tests (on jammy) are ok.

[Christian Ehrhardt  (paelzer)]

Jammy tests completed and good (Kinetic is the same).
Re-deploying older releases as time permits to check B/F.

[Christian Ehrhardt  (paelzer)]

Bionic worked for the features that existed back then (no vhost user client yet in the older tests as it was too new).

[Christian Ehrhardt  (paelzer)]

And finally also Focal completed all tests with the new build

[Christian Ehrhardt  (paelzer)]

Uploaded to Kinetic, mdeslaur will take care of the security updates to older releases.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dpdk - 21.11.2-0ubuntu1

---------------
dpdk (21.11.2-0ubuntu1) kinetic; urgency=medium

  * Merge LTS stable release 21.11.2 (LP: #1975764)
    - Among many general fixed this adresses two CVEs:
      + vhost: DoS triggered by sending a crafted Vhost header (CVE-2022-2132)
      + net/mlx5: bad error recovery can lead to DoS (CVE-2022-28199)
    - Full release notes are available at:
      https://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#id1

 -- Christian Ehrhardt <email address hidden> Thu, 08 Sep 2022 10:18:45 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package dpdk - 17.11.10-0ubuntu0.2

---------------
dpdk (17.11.10-0ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-2132-*.patch: discard tool small descriptor
      chains and fix header spanned across more than two descriptor, use
      buffer vectors in dequeue path in lib/librte_vhost/vhost.h,
      lib/librte_vhost/virtio_net.c. (LP: #1975764)
    - CVE-2022-2132

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 08 Sep 2022 12:48:45 -0300

[Marc Deslauriers (mdeslaur)]

This was published now:

https://lists.ubuntu.com/archives/ubuntu-security-announce/2022-September/006781.html