Skip to content
Fencer Vulns
high 8.1

CVE-2020-14305 json

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connec…

published 2020-12-02 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-6457

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.2%
EPSS 5.2% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Patch / fix

  • linux Debian 14, Debian 13, Debian 12 4.12.6-1

debian advisories DEBIAN-CVE-2020-14305

  • linux Ubuntu 16.04 LTS 4.4.0-187.217
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1112.124
  • linux-gcp Ubuntu 16.04 LTS 4.13.0-1002.5
  • linux-hwe Ubuntu 16.04 LTS 4.13.0-32.35~16.04.1
  • linux-kvm Ubuntu 16.04 LTS 4.4.0-1078.85
  • linux-azure Ubuntu 16.04 LTS 4.13.0-1005.7
  • linux-raspi2 Ubuntu 16.04 LTS 4.4.0-1137.146
  • linux-snapdragon Ubuntu 16.04 LTS 4.4.0-1141.149

ubuntu advisories UBUNTU-CVE-2020-14305

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 7 3.10.0-1160.el7
  • perf RHEL 7 3.10.0-1160.el7
  • bpftool RHEL 7 3.10.0-1160.el7
  • python-perf RHEL 7 3.10.0-1160.el7
  • kernel-kdump RHEL 7 3.10.0-1160.el7
  • kernel-tools RHEL 7 3.10.0-1160.el7
  • kernel-tools-libs RHEL 7 3.10.0-1160.el7
  • kernel-bootwrapper RHEL 7 3.10.0-1160.el7

red hat advisories RHSA-2020:4060RHSA-2020:4062

  • kernel-syms SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.150.1
  • kernel-source SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 4.4.180-94.150.1
  • kernel-default SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.150.1
  • kgraft-patch-SLE12-SP3_Update_41 SLES for SAP 12 SP3, SLES 12 SP3-LTSS, OpenStack Cloud Crowbar 8 +2 more 1-4.3.1
  • kernel-syms SLES 12 SP2-BCL 4.4.121-92.161.1
  • kernel-source SLES 12 SP2-BCL 4.4.121-92.161.1
  • kernel-default SLES 12 SP2-BCL 4.4.121-92.161.1

suse advisories SUSE-SU-2021:3935-1SUSE-SU-2021:3929-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14305 updated cvss 8.1

kernel: memory corruption in Voice over IP nf_conntrack_h323 module

  • Red Hat Enterprise MRG 2 kernel
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7
    fixed: vendor fix RHSA-2020:4060
  • Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1160.rt56.1131.el7, kernel-rt-trace 3.10.0-1160.rt56.1131.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.rt56.1131.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1160.rt56.1131.el7, kernel-rt-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-trace 3.10.0-1160.rt56.1131.el7, kernel-rt-debug-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-trace-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.rt56.1131.el7
    fixed: vendor fix RHSA-2020:4062
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-kdump 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, +7 more Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1160.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.el7 Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7
    fixed: vendor fix RHSA-2020:4060
  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-074-07 updated cvss 8.1

Siemens SIMATIC

  • Siemens SIMATIC RF160B (6GT2003-0FA00) <V2.2
    affected: mitigation “Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.” siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

5.15% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.openvz.org https://bugs.openvz.org/browse/OVZ-7188 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:N/AC:M/Au:N/C:P/I:P/A:C

Affected products

  • n/a kernel

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.