High severity · published Oct 16, 2020
CVE-2020-27174
In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firecracker · Amazon
before 0.21.3; 0.22.0 before 0.22.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27174
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/10/23/1
Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/2177
Patch
https://github.com/firecracker-microvm/firecracker/pull/2178
Patch
https://github.com/firecracker-microvm/firecracker/pull/2179
More from Firecracker
9.8
CVE-2019-18960
Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0
7.5
CVE-2026-5747
Out-of-bounds Write in Firecracker virtio-pci Transport
6.0
CVE-2026-1386
Arbitrary Host File Overwrite via Symlink in Firecracker Jailer
5.9
CVE-2020-16843
In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic