Read the docs
TI-2020-08653 Aliases CVE-2020-10756

Out-of-bounds read in Slirp

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

Why it matters now

EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Partial Slirp: 4.3.1Red Hat: 3 advisoriesRed Hat: 4 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Slirpbefore 4.3.14.3.1Patch availableCNA
  • Slirp Vendor— Affected before 4.3.1 Fixed in 4.3.1 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:*before 4.3.1VulnerableLibslirp Project
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:libslirp_project:libslirp:*:*:*:*:*:*:*:* Versions before 4.3.1 Vulnerable ·Libslirp Project
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · CNA Slirp Fixed in 4.3.1

Red Hat 3 advisories

  • RHSA-2020:4694 Released 2020-11-04 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.15.1-2.module+el8.3.0+8221+97165c3f.aarch64::container-tools:rhel8, buildah-1.15.1-2.module+el8.3.0+8221+97165c3f.ppc64le::container-tools:rhel8, buildah-1.15.1-2.module+el8.3.0+8221+97165c3f.s390x::container-tools:rhel8 +47
  • RHSA-2020:4059 Released 2020-09-29 · Red Hat rating Important
    virt:rhel security update
    • Red Hat CodeReady Linux Builder (v. 8) SLOF-20171214-6.gitfa98132.module+el8.1.0+4066+0f1aadab.src::virt-devel:rhel, hivex-1.3.15-7.module+el8.1.0+4066+0f1aadab.i686::virt-devel:rhel, hivex-devel-1.3.15-7.module+el8.1.0+4066+0f1aadab.i686::virt-devel:rhel +47
    • Red Hat Enterprise Linux AppStream (v. 8) SLOF-20171214-6.gitfa98132.module+el8.1.0+4066+0f1aadab.noarch::virt:rhel, SLOF-20171214-6.gitfa98132.module+el8.1.0+4066+0f1aadab.src::virt:rhel, hivex-1.3.15-7.module+el8.1.0+4066+0f1aadab.aarch64::virt:rhel +47
  • RHSA-2020:3586 Released 2020-09-01 · Red Hat rating Important
    virt:8.2 and virt-devel:8.2 security and bug fix update
    • Advanced Virtualization CodeReady Builder for RHEL 8.2.1 SLOF-20191022-3.git899d9883.module+el8.2.0+5449+efc036dd.src::virt-devel:8.2, hivex-1.3.18-20.module+el8.2.0+5588+63a201c3.i686::virt-devel:8.2, hivex-devel-1.3.18-20.module+el8.2.0+5588+63a201c3.i686::virt-devel:8.2 +47
    • Advanced Virtualization for RHEL 8.2.1 SLOF-20191022-3.git899d9883.module+el8.2.0+5449+efc036dd.noarch::virt:8.2, SLOF-20191022-3.git899d9883.module+el8.2.0+5449+efc036dd.src::virt:8.2, hivex-1.3.18-20.module+el8.2.0+5588+63a201c3.aarch64::virt:8.2 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 8 Advanced VirtualizationAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Advanced Virtualization CodeReady Builder for RHEL 8.2.1Fixed RHSA-2020:3586
Advanced Virtualization for RHEL 8.2.1Fixed RHSA-2020:3586
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:4059
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4059, RHSA-2020:4694
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10756

References

Patch 1

Advisory 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences