Information disclosure in Oracle Corporation Linux
CVE-2020-2732
A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.
Vulnerability class: Information Disclosure
EPSS: 0.009 (56.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Oracle Corporation Linux — versions 7, 6
- Redhat Enterprise_linux — versions 7.0, 8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert_us@oracle.com (Mailing List, Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Patch, Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Patch, Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Patch, Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Patch, Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert_us@oracle.com (Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (Third Party Advisory, x_refsource_MISC)
- secalert_us@oracle.com (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2020-2732?
- CVE-2020-2732 is a medium-severity vulnerability in Oracle Corporation Linux, classified under Information Disclosure. CVSS score: 5.8/10. Published 2020-04-08.
- How severe is CVE-2020-2732?
- Medium severity. CVSS v3 base score is 5.8 out of 10.
- Is CVE-2020-2732 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.