TI-2020-11245 Aliases CVE-2020-14377 GHSA-79mp-xxw2-fgf4

Out-of-bounds read in dpdk

LOW 31CWE-125Published 2020-09-30 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.

Why it matters now

EPSS 0.00411 35th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	dpdk	All dpdk versions before 18.11.10 and before 19.11.5	—	No fix listed	CNA

dpdk Vendor— Affected All dpdk versions before 18.11.10 and before 19.11.5 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:dpdk:data_plane_development_kit::::::::	18.02.1 to before 18.11.10; 19.02 to before 19.11.5	Vulnerable	DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::	20.04	Vulnerable	Canonical
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:leap:15.2:::::::*	15.2	Vulnerable	openSUSE

cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions 18.02.1 to before 18.11.10; 19.02 to before 19.11.5 Vulnerable ·DPDK
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1593
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
Show all 5 records → Advisory →
Advisory · 2020-09-30
dpdk — openSUSE-SU-2020:1599
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-11242 Buffer overflow in dpdkPriority LOW 38
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
Show all 5 records → Advisory →

Show 1 more group

Advisory · 2020-09-30
dpdk — USN-4550-1
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2020-11244 Buffer overflow in dpdkPriority LOW 34
- TI-2020-11243 Time-of-check time-of-use race condition in dpdkPriority LOW 34
- TI-2020-11246 Integer underflow in dpdkPriority LOW 16
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 8 products

Fast Datapath for RHEL 7
Fast Datapath for RHEL 8
Red Hat Ceph Storage 3
Red Hat Ceph Storage 4
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Virtualization 4

Timeline

2026-10-02 Threatist record created from CVE-2020-14377
2026-10-03 Alias added: GHSA-79mp-xxw2-fgf4

References

Patch 1

https://www.openwall.com/lists/oss-security/2020/09/28/3

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences