CVE-2020-14375
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors,...
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2020-14375- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-367
- Updated
- 2026-11-02
CVE List No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2020-14375- Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2020-6515 No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
EUVD-2020-6515- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m65p-x8wx-282m No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors,...
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
GHSA-m65p-x8wx-282m- Weakness
- CWE-367
- Updated
- 2026-11-02
OSV
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
CVE-2020-14375- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-14375
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
DEBIAN-CVE-2020-14375- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2020-14375
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Record
UBUNTU-CVE-2020-14375- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1593-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:1593-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1599-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 19.11.4
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590).
- For a list of fixes check: https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8 denial of service in the host (bsc#1176590).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1599-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10727-1 No score
dpdk-19.11.8-2.7 on GA media
These are all security issues fixed in the dpdk-19.11.8-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10727-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2767-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2767-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2768-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2768-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2769-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2769-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2770-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 19.11.4
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590).
- For a list of fixes check: https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8 denial of service in the host (bsc#1176590).
- Record
SUSE-SU-2020:2770-1- Updated
- 2026-11-02
OSVUSN-4550-1 No score
dpdk vulnerabilities
Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host.
- Record
USN-4550-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dpdkDebian:12 |
before 19.11.5-1 | 19.11.5-1 |
dpdkDebian:13 |
before 19.11.5-1 | 19.11.5-1 |
dpdkDebian:14 |
before 19.11.5-1 | 19.11.5-1 |
dpdkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dpdkSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP1 From an advisory covering 5 CVEs |
before 18.11.9-4.12.1 | 18.11.9-4.12.1 |
dpdkSUSE:Linux Enterprise Module for Package Hub 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdk-thunderxSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdkUbuntu:20.04:LTS |
before 19.11.3-0ubuntu0.2, plus listed versions 18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1 Show 5 moreShow less19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.1 |
19.11.3-0ubuntu0.2 |
dpdkUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 19.11.3-0ubuntu0.2, plus listed versions 18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1 Show 5 moreShow less19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.1 |
19.11.3-0ubuntu0.2 |
dpdkopenSUSE:Leap 15.1 From an advisory covering 5 CVEs |
before 18.11.9-lp151.3.8.1 | 18.11.9-lp151.3.8.1 |
dpdkopenSUSE:Leap 15.2 From an advisory covering 5 CVEs |
before 19.11.4-lp152.2.8.1 | 19.11.4-lp152.2.8.1 |
dpdkopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 19.11.8-2.7 | 19.11.8-2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14375 is a high vulnerability (CVSS 7.8) in [unknown] Dpdk, published September 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in dpdk 19.11.5-1.
References
bugzilla.redhat.com/show_bug.cgi?id=1879468
openwall.com/lists/oss-security/2020/09/28/3
usn.ubuntu.com/4550-1
lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html
Show 28 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-14375
github.com/advisories/GHSA-m65p-x8wx-282m
security-tracker.debian.org/tracker/CVE-2020-14375
suse.com/support/update/announcement/2020/suse-su-20202767-1
bugzilla.suse.com/1176590
ubuntu.com/security/CVE-2020-14375
cve.org/CVERecord?id=CVE-2020-14375