CVE-2020-14374: Buffer Overflow
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copydata function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhostcrypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Flawed bounds checking in the copydata function leads to a buffer overflow. An attacker in a virtual machine can leverage the buffer overflow to write arbitrary data to any address in the vhostcrypto application. The vulnerability can be used to gain code execution in the vhostcrypto process. This vulnerability is a complete compromise of the virtual machine host-guest isolation.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14374.
What is the severity of CVE-2020-14374?
CVE-2020-14374 has a severity rating of 8.8, which is classified as high.
Which software versions are affected by CVE-2020-14374?
CVE-2020-14374 affects dpdk versions before 18.11.10 and before 19.11.5.
How does CVE-2020-14374 impact virtual machines?
CVE-2020-14374 allows an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application.
Are there any relevant references for CVE-2020-14374?
Yes, you can find more information about CVE-2020-14374 in the following references: - [http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html](http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html) - [http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html](http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html) - [http://www.openwall.com/lists/oss-security/2021/01/04/1](http://www.openwall.com/lists/oss-security/2021/01/04/1)