CVE-2020-16843

Опубликовано: 04 авг. 2020

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service on the microVM when it is configured with a single network interface, and an availability problem for the microVM network interface on which the issue is triggered.

Ссылки

http://www.openwall.com/lists/oss-security/2020/08/13/1
Mailing List
Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/2057
Mitigation
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/08/13/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/08/13/1
Mailing List
Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/2057
Mitigation
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/08/13/1
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:amazon:firecracker:0.20.0:*:*:*:*:*:*:*

cpe:2.3:a:amazon:firecracker:0.21.0:*:*:*:*:*:*:*

cpe:2.3:a:amazon:firecracker:0.21.1:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01674

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-mq2v-3xvx-978w

github

больше 4 лет назад

ALT-PU-2020-3247

CVSS3: 7.5

altlinux

около 6 лет назад

ALT-PU-2020-3247: package `firecracker` update to version 0.23.0-alt1