{"id":"CVE-2020-14375","aliases":["DEBIAN-CVE-2020-14375","EUVD-2020-6515","GHSA-m65p-x8wx-282m","SUSE-SU-2020:2767-1","SUSE-SU-2020:2768-1","SUSE-SU-2020:2769-1","SUSE-SU-2020:2770-1","UBUNTU-CVE-2020-14375","USN-4550-1","openSUSE-SU-2020:1593-1","openSUSE-SU-2020:1599-1","openSUSE-SU-2024:10727-1"],"status":"published","title":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors,...","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0025,"percentile":0.16466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2020-09-28T15:00:00Z","modified":"2026-10-26T12:01:37Z","fixes":[{"ecosystem":"Debian:12","package":"dpdk","fixed_in":["19.11.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dpdk","fixed_in":["19.11.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dpdk","fixed_in":["19.11.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"dpdk","fixed_in":["19.11.3-0ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.5-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.4-3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.4-3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.4-3.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.3-0ubuntu0.2"}]}],"versions":["18.11.2-4","18.11.3-1","18.11.4-1","18.11.4-1ubuntu1","18.11.5-1","19.11-2ubuntu1","19.11-2ubuntu2","19.11.1-0ubuntu1","19.11.1-0ubuntu1.1","19.11.3-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.3-0ubuntu0.2"}]}],"versions":["18.11.2-4","18.11.3-1","18.11.4-1","18.11.4-1ubuntu1","18.11.5-1","19.11-2ubuntu1","19.11-2ubuntu2","19.11.1-0ubuntu1","19.11.1-0ubuntu1.1","19.11.3-0ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.11.9-lp151.3.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.4-lp152.2.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.11.8-2.7"}]}],"bundled":8}],"products":[{"vendor":"[unknown]","product":"dpdk"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"dpdk","product":"data_plane_development_kit"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879468","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/09/28/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4550-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/04/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/04/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/04/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14375"},{"url":"https://github.com/advisories/GHSA-m65p-x8wx-282m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14375","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202767-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176590","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14378","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202768-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202769-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202770-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-14375","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4550-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14378","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DHAHOAWA3IFFTJQJPZPP5JIAYVJJDVE4/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YBSGY453NNB4LDJYA3J7SNEOJKG5HCAD/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10725","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14375","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-30T18:42:58Z","modified":"2024-08-04T12:46:34.328Z","cwes":["CWE-367"],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6515","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-30T18:42:58Z","modified":"2024-08-04T12:46:34Z","updated_at":"2026-11-03T03:07:34.099541Z"}],"ghsa":[{"id":"GHSA-m65p-x8wx-282m","title":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors,...","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2022-05-24T17:29:47Z","modified":"2023-01-29T05:04:14Z","cwes":["CWE-367"],"updated_at":"2026-11-02T14:45:30.341086Z"}],"nvd":[{"id":"CVE-2020-14375","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-30T19:15:12.76Z","modified":"2026-06-17T02:54:39.033Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-14375","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-30T19:15:12.76Z","modified":"2026-03-15T22:33:25.11673Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14375","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-30T19:15:12.76Z","modified":"2026-10-26T12:01:37.282939547Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-14375","description":"A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated it. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2020-09-28T15:00:00Z","modified":"2026-04-22T12:29:24.601871Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"openSUSE-SU-2020:1593-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 18.11.9. For a list of fixes check:\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\nFor a list of fixes check:    \n    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-10-03T04:23:08Z","modified":"2026-02-04T02:17:57.407815Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1599-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 19.11.4\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\n- For a list of fixes check:\n  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8\n  denial of service in the host (bsc#1176590).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-03T22:22:25Z","modified":"2026-02-04T04:17:12.023863Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10727-1","title":"dpdk-19.11.8-2.7 on GA media","description":"These are all security issues fixed in the dpdk-19.11.8-2.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:53.124695Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:2767-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 18.11.9. For a list of fixes check:\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\nFor a list of fixes check:    \n    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes\n","status":"published","published":"2020-09-28T15:48:33Z","modified":"2026-02-04T03:24:20.853296Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2768-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 18.11.9. For a list of fixes check:\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\nFor a list of fixes check:    \n    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes\t  \n","status":"published","published":"2020-09-28T15:48:53Z","modified":"2026-02-04T03:58:14.683894Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2769-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 18.11.9. For a list of fixes check:\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\nFor a list of fixes check:    \n    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes\n","status":"published","published":"2020-09-28T15:49:12Z","modified":"2026-02-04T03:28:34.252493Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2770-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- dpdk was updated to 19.11.4\n  - CVE-2020-14374,CVE-2020-14375,CVE-2020-14376,CVE-2020-14377,CVE-2020-14378: Fixed multiple issues where a malicious guest could \n    harm the host using vhost crypto, including executing code in host (VM Escape), reading host application memory space to guest \n    and causing partially denial of service in the host(bsc#1176590).\n- For a list of fixes check:\n  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8\n  denial of service in the host (bsc#1176590).\n","status":"published","published":"2020-09-28T15:49:35Z","modified":"2026-02-04T04:29:22.436766Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4550-1","title":"dpdk vulnerabilities","description":"Ryan Hall discovered that DPDK incorrectly handled vhost crypto. An\nattacker inside a guest could use these issues to perform multiple attacks,\nincluding denial of service attacks, obtaining sensitive information from\nthe host, and possibly executing arbitrary code on the host.\n","status":"published","published":"2020-09-28T16:32:13Z","modified":"2026-04-22T10:08:23.964036Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}