Medium severity · published Aug 4, 2020
CVE-2020-16843
In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic
5.9
CVSS
1.7%
EPSS
No
On KEV
Description
In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service on the microVM when it is configured with a single network interface, and an availability problem for the microVM network interface on which the issue is triggered.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firecracker · Amazon
0.20.0; 0.21.0; 0.21.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16843
Mailing List
http://www.openwall.com/lists/oss-security/2020/08/13/1
Mitigation
https://github.com/firecracker-microvm/firecracker/issues/2057
Mailing List
https://www.openwall.com/lists/oss-security/2020/08/13/1
More from Firecracker
9.8
CVE-2019-18960
Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0
7.5
CVE-2026-5747
Out-of-bounds Write in Firecracker virtio-pci Transport
7.5
CVE-2020-27174
In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input
6.0
CVE-2026-1386
Arbitrary Host File Overwrite via Symlink in Firecracker Jailer