PT-2020-14890 · Amazon+1 · Firecracker+1

Serban Iorga · Published 2020-08-04 · Updated 2020-11-10 · CVE-2020-16843

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Firecracker versions 0.20.x through 0.20.0 Firecracker versions 0.21.x through 0.21.1

Description The network stack can freeze under heavy ingress traffic, resulting in a denial of service on the microVM when it is configured with a single network interface, and an availability problem for the microVM network interface on which the issue is triggered.

Recommendations For Firecracker versions 0.20.x through 0.20.0, update to version 0.20.1 or later. For Firecracker versions 0.21.x through 0.21.1, update to version 0.21.2 or later.

Fix

Related Identifiers

ALT-PU-2020-3247

CVE-2020-16843

Affected Products

Alt Linux

Firecracker

References · 5

• https://osv.dev/vulnerability/CVE-2020-16843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16843 · Security Note
• https://github.com/firecracker-microvm/firecracker/issues/2057 · Note
• http://openwall.com/lists/oss-security/2020/08/13/1 · Note
• https://openwall.com/lists/oss-security/2020/08/13/1 · Note