CVE-2020-14377
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of...
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
CVE-2020-14377- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
CVE-2020-14377- Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2020-6517 No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
EUVD-2020-6517- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-79mp-xxw2-fgf4 No score
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of...
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
GHSA-79mp-xxw2-fgf4- Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
CVE-2020-14377- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-14377
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
DEBIAN-CVE-2020-14377- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2020-14377
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attacker in a virtual machine to read significant amounts of host memory. The highest threat from this vulnerability is to data confidentiality and system availability.
- Record
UBUNTU-CVE-2020-14377- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1593-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:1593-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1599-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 19.11.4
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590).
- For a list of fixes check: https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8 denial of service in the host (bsc#1176590).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1599-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2767-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2767-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2768-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2768-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2769-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 18.11.9. For a list of fixes check:
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could
harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest
and causing partially denial of service in the host(bsc#1176590).
For a list of fixes check:
- Record
SUSE-SU-2020:2769-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2770-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- dpdk was updated to 19.11.4
- CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest and causing partially denial of service in the host(bsc#1176590).
- For a list of fixes check: https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8 denial of service in the host (bsc#1176590).
- Record
SUSE-SU-2020:2770-1- Updated
- 2026-11-02
OSVUSN-4550-1 No score
dpdk vulnerabilities
Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An attacker inside a guest could use these issues to perform multiple attacks, including denial of service attacks, obtaining sensitive information from the host, and possibly executing arbitrary code on the host.
- Record
USN-4550-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dpdkDebian:12 |
before 19.11.5-1 | 19.11.5-1 |
dpdkDebian:13 |
before 19.11.5-1 | 19.11.5-1 |
dpdkDebian:14 |
before 19.11.5-1 | 19.11.5-1 |
dpdkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdk-thunderxSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
dpdkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 5 CVEs |
before 18.11.9-3.25.1 | 18.11.9-3.25.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dpdkSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 18.11.9-3.15.1 | 18.11.9-3.15.1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP1 From an advisory covering 5 CVEs |
before 18.11.9-4.12.1 | 18.11.9-4.12.1 |
dpdkSUSE:Linux Enterprise Module for Package Hub 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdk-thunderxSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 5 CVEs |
before 19.11.4-3.9.1 | 19.11.4-3.9.1 |
dpdkUbuntu:20.04:LTS |
before 19.11.3-0ubuntu0.2, plus listed versions 18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1 Show 5 moreShow less19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.1 |
19.11.3-0ubuntu0.2 |
dpdkUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 19.11.3-0ubuntu0.2, plus listed versions 18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1 Show 5 moreShow less19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.1 |
19.11.3-0ubuntu0.2 |
dpdkopenSUSE:Leap 15.1 From an advisory covering 5 CVEs |
before 18.11.9-lp151.3.8.1 | 18.11.9-lp151.3.8.1 |
dpdkopenSUSE:Leap 15.2 From an advisory covering 5 CVEs |
before 19.11.4-lp152.2.8.1 | 19.11.4-lp152.2.8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14377 is a high vulnerability (CVSS 7.1) in [unknown] Dpdk, published September 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in dpdk 19.11.5-1.
References
openwall.com/lists/oss-security/2020/09/28/3
bugzilla.redhat.com/show_bug.cgi?id=1879472
usn.ubuntu.com/4550-1
lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html
Show 24 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-14377
github.com/advisories/GHSA-79mp-xxw2-fgf4
security-tracker.debian.org/tracker/CVE-2020-14377
suse.com/support/update/announcement/2020/suse-su-20202767-1
bugzilla.suse.com/1176590
ubuntu.com/security/CVE-2020-14377
cve.org/CVERecord?id=CVE-2020-14377