CVE-2020-14339

Katalog CVE

CVSS 8.8 · High EPSS 0,42%

Kerentanan Missing Release of Resource after Effective Lifetime pada redhat libvirt, redhat enterprise linux. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Rincian

Terbit di NVD

3 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1860069 issue tracking · patch · advisory pihak ketiga
• https://security.gentoo.org/glsa/202101-22 advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-06 advisory pihak ketiga