PT-2020-13988 · Intel+4 · Dpdk+4

Ryan Hall · Published 2020-09-28 · Updated 2021-06-24 · CVE-2020-14377

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions dpdk versions prior to 18.11.10 dpdk versions prior to 19.11.5

Description A flaw in dpdk allows an attacker to read significant amounts of host memory due to a lack of validation of attacker-controlled parameters, leading to a buffer over read. The results of the over read are then written back to the guest virtual machine memory, posing a threat to data confidentiality and system availability.

Recommendations For versions prior to 18.11.10, update to version 18.11.10 or later. For versions prior to 19.11.5, update to version 19.11.5 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2020-3518

ALT-PU-2021-1176

ALT-PU-2021-2053

CVE-2020-14377

OPENSUSE-SU-2020:1593-1

OPENSUSE-SU-2020:1599-1

OPENSUSE-SU-2020_1593-1

OPENSUSE-SU-2020_1599-1

SUSE-SU-2020:2767-1

SUSE-SU-2020:2768-1

SUSE-SU-2020:2769-1

SUSE-SU-2020:2770-1

USN-4550-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Dpdk

References · 39

• https://osv.dev/vulnerability/CVE-2020-14377 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14376 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14377 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/09/28/3 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1599-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14378 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14377 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4550-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2769-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1593-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2768-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4550-1 · Vendor Advisory