TI-2020-11244 Aliases CVE-2020-14376 GHSA-rmx4-hffj-96cf

Buffer overflow in dpdk

LOW 34CWE-120Published 2020-09-30 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Why it matters now

EPSS 0.00395 33rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	dpdk	All dpdk versions before 18.11.10 and before 19.11.5	—	No fix listed	CNA

dpdk Vendor— Affected All dpdk versions before 18.11.10 and before 19.11.5 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:dpdk:data_plane_development_kit::::::::	18.02.1 to before 18.11.10; 19.02 to before 19.11.5	Vulnerable	DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	20.04	Vulnerable	Canonical
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.2:::::::*	15.2	Vulnerable	openSUSE

cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions 18.02.1 to before 18.11.10; 19.02 to before 19.11.5 Vulnerable ·DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1593
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
- TI-2020-11245 Out-of-bounds read in dpdkPriority LOW 31
Show all 5 records → Advisory →
Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1599
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
- TI-2020-11245 Out-of-bounds read in dpdkPriority LOW 31
Show all 5 records → Advisory →

Show 1 more group

Advisory · 2020-09-30
dpdk — USN-4550-1
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
- TI-2020-11245 Out-of-bounds read in dpdkPriority LOW 31
- TI-2020-11246 Integer underflow in dpdkPriority LOW 16
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 8 products

Fast Datapath for RHEL 7
Fast Datapath for RHEL 8
Red Hat Ceph Storage 3
Red Hat Ceph Storage 4
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Virtualization 4

Timeline

2026-10-02 Threatist record created from CVE-2020-14376
2026-10-03 Alias added: GHSA-rmx4-hffj-96cf

References

Patch 1

https://www.openwall.com/lists/oss-security/2020/09/28/3

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences