PT-2020-13986 · Linux Foundation+4 · Dpdk+4

Ryan Hall · Published 2020-09-28 · Updated 2024-06-15 · CVE-2020-14375

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dpdk versions prior to 18.11.10 dpdk versions prior to 19.11.5

Description A flaw was found in dpdk where virtio ring descriptors and the data they describe are in a region of memory accessible by both the virtual machine and the host. An attacker in a VM can change the contents of the memory after validation. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations For versions prior to 18.11.10, update to version 18.11.10 or later. For versions prior to 19.11.5, update to version 19.11.5 or later.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

ALT-PU-2020-3518

ALT-PU-2021-1176

ALT-PU-2021-2053

CVE-2020-14375

OPENSUSE-SU-2020:1593-1

OPENSUSE-SU-2020:1599-1

OPENSUSE-SU-2020_1593-1

OPENSUSE-SU-2020_1599-1

OPENSUSE-SU-2024:10727-1

SUSE-SU-2020:2767-1

SUSE-SU-2020:2768-1

SUSE-SU-2020:2769-1

SUSE-SU-2020:2770-1

USN-4550-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Dpdk

References · 45

• https://ubuntu.com/security/CVE-2020-14376 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14375 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14375 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/28/3 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1599-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2770-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14375 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14378 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4550-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14375 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:2769-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4550-1 · Vendor Advisory