CVE-2020-27174

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Missing Release of Memory after Effective Lifetime pada amazon firecracker. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.

Rincian

Terbit di NVD

16 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/firecracker-microvm/firecracker/pull/2178 patch · advisory pihak ketiga
• https://github.com/firecracker-microvm/firecracker/pull/2179 patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/10/23/1 advisory pihak ketiga
• https://github.com/firecracker-microvm/firecracker/issues/2177 advisory pihak ketiga