Vulnerability · Published Apr 8, 2020 · Assigned by oracle
CVE-2020-2732
Medium 5.8
In plain English
A medium-severity security flaw in Oracle Linux from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.5.13-1 | DEBIAN-CVE-2020-2732 |
| Debian:13 | linux | 5.5.13-1 | DEBIAN-CVE-2020-2732 |
| Debian:14 | linux | 5.5.13-1 | DEBIAN-CVE-2020-2732 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-2732 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-2732 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-2732 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-2732 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Oracle Linux | 76 |
References
- https://www.openwall.com/lists/oss-security/2020/02/25/3 x_refsource_MISC
- https://www.spinics.net/lists/kvm/msg208259.html x_refsource_MISC
- https://git.kernel.org/linus/07721feee46b4b248402133228235318199b05ec x_refsource_MISC
- https://git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c x_refsource_MISC
- https://git.kernel.org/linus/e71237d3ff1abf9f3388337cfebf53b96df2020d x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1805135 x_refsource_MISC
- https://linux.oracle.com/errata/ELSA-2020-5540.html x_refsource_MISC
- https://linux.oracle.com/errata/ELSA-2020-5542.html x_refsource_MISC
- https://linux.oracle.com/errata/ELSA-2020-5543.html x_refsource_MISC
- DSA-4667 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20200609 [SECURITY] [DLA 2241-1] linux security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2242-1] linux-4.9 security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200610 [SECURITY] [DLA 2241-2] linux security update mailing-list, x_refsource_MLIST
- DSA-4698 vendor-advisory, x_refsource_DEBIAN