CVE-2020-10724

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read.

Published: May 19, 2020
Updated: Apr 13, 2023
CVE: CVE-2020-10724
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.4
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-125

Affected Software
References

Software	From	Fixed in
dpdk / data_plane_development_kit	-	18.11.x
canonical / ubuntu_linux	18.04	18.04.x
canonical / ubuntu_linux	19.10	19.10.x
fedoraproject / fedora	32	32.x
canonical / ubuntu_linux	20.04	20.04.x

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html
https://bugs.dpdk.org/show_bug.cgi?id=269
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10724
https://lists.fedoraproject.org/archives/list/[email protected]/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/
https://usn.ubuntu.com/4362-1/
https://www.openwall.com/lists/oss-security/2020/05/18/2
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html

Vulnerability Database

289,599

CVE-2020-10724