Every CVE Search/ Get API key

CVE-2020-10724

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is...

5.1 MediumFix available

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.35%Down 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.1

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
CVE-2020-10724
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2020-3151 5.1

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
EUVD-2020-3151
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-ffrh-qjc2-38wm No score

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is...

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
GHSA-ffrh-qjc2-38wm
Weakness
CWE-125, CWE-190
Updated
2026-11-02
NVD 5.1

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
CVE-2020-10724
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-190, CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2020-10724 4.4

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
ALPINE-CVE-2020-10724
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVAZL-38527 4.4

CVE-2020-10724 affecting package ceph for versions less than 18.2.2-1

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
AZL-38527
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-05
Show 12 moreShow less
OSV 4.4

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
CVE-2020-10724
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-10724 4.4

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
DEBIAN-CVE-2020-10724
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2020:2295 7.7

Red Hat Security Advisory: openvswitch2.13 security, bug fix and enhancement update

Record
RHSA-2020:2295
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:2296 6.7

Red Hat Security Advisory: openvswitch2.11 security, bug fix and enhancement update

Record
RHSA-2020:2296
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:2297 6.7

Red Hat Security Advisory: openvswitch2.11 security, bug fix and enhancement update

Record
RHSA-2020:2297
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0931 9.8

Red Hat Security Advisory: openvswitch2.11 and ovn2.11 security update

Record
RHSA-2021:0931
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-10724 4.4

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Record
UBUNTU-CVE-2020-10724
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2020:0693-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

Security issues fixed:

  • CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477).
  • CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).
  • CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477).
  • CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477).
  • CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2020:0693-1
Updated
2026-11-02
OSVSUSE-SU-2020:1334-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

Security issues fixed:

  • CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477).
  • CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).
  • CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477).
  • CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477).
  • CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477).
Record
SUSE-SU-2020:1334-1
Updated
2026-11-02
OSVSUSE-SU-2020:1335-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

Security issues fixed:

  • CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171477).
  • CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171477).
  • CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171477).
  • CVE-2020-10725: Fixed a segfault caused by invalid virtio descriptors sent from a malicious guest (bsc#1171477).
  • CVE-2020-10726: Fixed a denial-of-service caused by VHOST_USER_GET_INFLIGHT_FD message flooding (bsc#1171477).
Record
SUSE-SU-2020:1335-1
Updated
2026-11-02
OSVSUSE-SU-2020:1552-1 No score

Security update for dpdk

This update for dpdk fixes the following issues:

  • CVE-2020-10722: Fixed an integer overflow in vhost_user_set_log_base() (bsc#1171930).
  • CVE-2020-10723: Fixed an integer truncation in vhost_user_check_and_alloc_queue_pair() (bsc#1171925).
  • CVE-2020-10724: Fixed a missing inputs validation in Vhost-crypto (bsc#1171926).
Record
SUSE-SU-2020:1552-1
Updated
2026-11-02
OSVUSN-4362-1 No score

dpdk vulnerabilities

It was discovered that DPDK incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2020-10722, CVE-2020-10723, CVE-2020-10724, CVE-2020-10725, CVE-2020-10726)

Record
USN-4362-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvswitch
Alpine:v3.13
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.14
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.15
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.16
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.17
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.18
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.19
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.20
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.21
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.22
 before 2.12.1-r0
2.12.1-r0
Show 56 moreShow less
Affected packages
PackageAffectedFixed
openvswitch
Alpine:v3.23
 before 2.12.1-r0
2.12.1-r0
openvswitch
Alpine:v3.24
 before 2.12.1-r0
2.12.1-r0
ceph
Azure Linux:3
 before 18.2.2-1
18.2.2-1
dpdk
Debian:12
 before 19.11.2-1
19.11.2-1
dpdk
Debian:13
 before 19.11.2-1
19.11.2-1
dpdk
Debian:14
 before 19.11.2-1
19.11.2-1
network-scripts-openvswitch2.13
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.13
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.13-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.13-debugsource
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.13-devel
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.13-test
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
python3-openvswitch2.13
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
python3-openvswitch2.13-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 5 CVEs
 before 0:2.13.0-25.el8fdp.1
0:2.13.0-25.el8fdp.1
openvswitch2.11
Red Hat:enterprise_linux:7::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el7fdp
0:2.11.0-54.20200327gita4efc59.el7fdp
openvswitch2.11-debuginfo
Red Hat:enterprise_linux:7::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el7fdp
0:2.11.0-54.20200327gita4efc59.el7fdp
openvswitch2.11-devel
Red Hat:enterprise_linux:7::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el7fdp
0:2.11.0-54.20200327gita4efc59.el7fdp
openvswitch2.11-test
Red Hat:enterprise_linux:7::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el7fdp
0:2.11.0-54.20200327gita4efc59.el7fdp
python-openvswitch2.11
Red Hat:enterprise_linux:7::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el7fdp
0:2.11.0-54.20200327gita4efc59.el7fdp
network-scripts-openvswitch2.11
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch2.11
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch2.11-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch2.11-debugsource
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch2.11-devel
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch2.11-test
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
python3-openvswitch2.11
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
python3-openvswitch2.11-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 3 CVEs
 before 0:2.11.0-54.20200327gita4efc59.el8fdp
0:2.11.0-54.20200327gita4efc59.el8fdp
openvswitch-selinux-extra-policy
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:1.0-17.el7fdp
0:1.0-17.el7fdp
openvswitch2.11
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.3-77.el7fdp
0:2.11.3-77.el7fdp
openvswitch2.11-debuginfo
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.3-77.el7fdp
0:2.11.3-77.el7fdp
openvswitch2.11-devel
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.3-77.el7fdp
0:2.11.3-77.el7fdp
ovn2.11
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.1-57.el7fdp
0:2.11.1-57.el7fdp
ovn2.11-central
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.1-57.el7fdp
0:2.11.1-57.el7fdp
ovn2.11-debuginfo
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.1-57.el7fdp
0:2.11.1-57.el7fdp
ovn2.11-host
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.1-57.el7fdp
0:2.11.1-57.el7fdp
ovn2.11-vtep
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.1-57.el7fdp
0:2.11.1-57.el7fdp
python-openvswitch2.11
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.3-77.el7fdp
0:2.11.3-77.el7fdp
openvswitch2.11-test
Red Hat:openstack:13::el7
From an advisory covering 4 CVEs
 before 0:2.11.3-77.el7fdp
0:2.11.3-77.el7fdp
dpdk
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk-thunderx
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk-thunderx
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk-thunderx
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 5 CVEs
 before 18.11.3-3.19.2
18.11.3-3.19.2
dpdk
SUSE:Linux Enterprise Module for Server Applications 15 SP1
From an advisory covering 5 CVEs
 before 18.11.3-4.6.2
18.11.3-4.6.2
dpdk
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk-thunderx
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk-thunderx
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk-thunderx
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 18.11.3-3.9.2
18.11.3-3.9.2
dpdk
Ubuntu:20.04:LTS
 before 19.11.1-0ubuntu1.1, plus listed versions
18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-119.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu1
19.11.1-0ubuntu1.1
dpdk
Ubuntu:18.04:LTS
From an advisory covering 5 CVEs
 before 17.11.9-0ubuntu18.04.2, plus listed versions
17.05.2-0ubuntu117.05.2-0ubuntu217.11-317.11-417.11-5
Show 7 moreShow less
17.11.1-617.11.2-1ubuntu0.117.11.3-3~ubuntu0.18.0417.11.5-0~ubuntu18.04.117.11.6-0~ubuntu18.04.117.11.8-0~ubuntu18.04.217.11.9-0ubuntu18.04.1
17.11.9-0ubuntu18.04.2
dpdk
Ubuntu:20.04:LTS
From an advisory covering 5 CVEs
 before 19.11.1-0ubuntu1.1, plus listed versions
18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-119.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu1
19.11.1-0ubuntu1.1
dpdk
openSUSE:Leap 15.1
From an advisory covering 5 CVEs
 before 18.11.3-lp151.3.4.1
18.11.3-lp151.3.4.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-10724 is a medium vulnerability (CVSS 5.1) in [unknown] Dpdk, published May 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in openvswitch 2.12.1-r0.

References

Show 69 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open