CVE-2020-2732 MEDIUM

CVE-2020-2732

Vendor Oracle Corporation
Product Oracle Linux
Published April 8, 2020
Last update September 30, 2024

CVSS base score

5.8/10
Attack vector Adjacent
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.

Key dates

02Disclosure timeline

April 8, 2020 CVE published
September 30, 2024 Record updated