PT-2020-13985 · Intel+4 · Dpdk+4

Ryan Hall · Published 2020-09-28 · Updated 2024-06-15 · CVE-2020-14374

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dpdk versions prior to 18.11.10 dpdk versions prior to 19.11.5

Description A flaw was found in the copy data function due to flawed bounds checking, leading to a buffer overflow. This allows an attacker in a virtual machine to write arbitrary data to any address in the vhost crypto application, posing a threat to data confidentiality and integrity, as well as system availability.

Recommendations For versions prior to 18.11.10, update to version 18.11.10 or later. For versions prior to 19.11.5, update to version 19.11.5 or later. As a temporary workaround, consider restricting access to the vhost crypto application until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2020-3518

ALT-PU-2021-1176

ALT-PU-2021-2053

CVE-2020-14374

OPENSUSE-SU-2020:1593-1

OPENSUSE-SU-2020:1599-1

OPENSUSE-SU-2020_1593-1

OPENSUSE-SU-2020_1599-1

OPENSUSE-SU-2024:10727-1

SUSE-SU-2020:2767-1

SUSE-SU-2020:2768-1

SUSE-SU-2020:2769-1

SUSE-SU-2020:2770-1

SUSE-SU-2020_2767-1

SUSE-SU-2020_2768-1

SUSE-SU-2020_2769-1

SUSE-SU-2020_2770-1

USN-4550-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Dpdk

References · 43

• https://ubuntu.com/security/CVE-2020-14376 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/01/04/1 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14374 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/28/3 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1599-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14374 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14378 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/01/04/2 · Patch
• https://osv.dev/vulnerability/USN-4550-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14374 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-14374 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2769-1 · Vendor Advisory