Log in Start free

Vulnerability · Published Sep 30, 2020 · Assigned by redhat

CVE-2020-14377

High 7.1

In plain English

A high-severity out-of-bounds read in dpdk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.1High
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12dpdk19.11.5-1DEBIAN-CVE-2020-14377
Debian:13dpdk19.11.5-1DEBIAN-CVE-2020-14377
Debian:14dpdk19.11.5-1DEBIAN-CVE-2020-14377

Affected products (as reported)

VendorProductVersions
n/a dpdk All dpdk versions before 18.11.10 and before 19.11.5

Weakness: CWE-125

References