CVE-2020-14375

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada dpdk data plane development kit, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD

30 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openwall.com/lists/oss-security/2020/09/28/3 mailing list · patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html advisory pihak ketiga
• https://usn.ubuntu.com/4550-1/ advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/01/04/1 mailing list
• http://www.openwall.com/lists/oss-security/2021/01/04/2 mailing list
• http://www.openwall.com/lists/oss-security/2021/01/04/5 mailing list
• https://bugzilla.redhat.com/show_bug.cgi?id=1879468 issue tracking