medium 5.8

CVE-2020-2732 json

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enable…

published 2020-04-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-22525

cvss: 5.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest.

Patch / fix

distros 6 links 4

debian ubuntu red hat suse opensuse arch linux

linux Debian 14, Debian 13, Debian 12 5.5.13-1

debian advisories DEBIAN-CVE-2020-2732

linux Ubuntu 16.04 LTS 4.4.0-176.206
linux Ubuntu 18.04 LTS 4.15.0-91.92
linux-aws Ubuntu 16.04 LTS 4.4.0-1104.115
linux-aws Ubuntu 18.04 LTS 4.15.0-1063.67
linux-gcp Ubuntu 16.04 LTS 4.15.0-1058.62
linux-gcp Ubuntu 18.04 LTS 5.0.0-1033.34
linux-hwe Ubuntu 16.04 LTS 4.15.0-91.92~16.04.1
linux-hwe Ubuntu 18.04 LTS 5.3.0-42.34~18.04.1

ubuntu advisories UBUNTU-CVE-2020-2732

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-193.1.2.el8_2
perf RHEL 8 4.18.0-193.1.2.el8_2
bpftool RHEL 8 4.18.0-193.1.2.el8_2
kernel-core RHEL 8 4.18.0-193.1.2.el8_2
kernel-tools RHEL 8 4.18.0-193.1.2.el8_2
python3-perf RHEL 8 4.18.0-193.1.2.el8_2
kernel-modules RHEL 8 4.18.0-193.1.2.el8_2
kernel-zfcpdump RHEL 8 4.18.0-193.1.2.el8_2

red hat advisories RHSA-2020:2102 RHSA-2020:4060 RHSA-2020:4062 RHSA-2020:2171

kernel-syms SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-source SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-default SLES for SAP 15, SLES 15-LTSS, SLE Live Patching 15 +3 more 4.12.14-150.52.1
kernel-vanilla SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-obs-build SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-syms SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 4.4.121-92.129.1
kernel-source SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 4.4.121-92.129.1
kernel-default SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 4.4.121-92.129.1

suse advisories SUSE-SU-2020:1663-1 SUSE-SU-2020:1255-1 SUSE-SU-2020:1275-1 SUSE-SU-2020:1142-1 SUSE-SU-2020:1087-1 SUSE-SU-2020:0688-1

kernel-source openSUSE Tumbleweed 5.14.6-1.4
kernel-source openSUSE Tumbleweed 6.6.17-1.1
kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-source openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-default openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-vanilla openSUSE Leap 15.1 4.12.14-lp151.28.40.1
kernel-kvmsmall openSUSE Leap 15.1 4.12.14-lp151.28.40.1

opensuse advisories openSUSE-SU-2024:10728-1 openSUSE-SU-2024:13704-1 openSUSE-SU-2020:0336-1

linux Arch Linux 5.5.7.arch1-1

arch linux advisories AVG-1108

spinics.net/lists/kvm/msg208259.html advisory
git.kernel.org/linus/07721feee46b4b248402133228235318199b05ec advisory
git.kernel.org/linus/35a571346a94fb93b5b3b6a599675ef3384bc75c advisory
git.kernel.org/linus/e71237d3ff1abf9f3388337cfebf53b96df2020d advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-2732 updated 2026-11-07 cvss 5.8

Kernel: kvm: nVMX: L2 guest may trick the L0 hypervisor to access sensitive L1 resources

Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-193.1.2.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.1.2.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.1.2.el8_2 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-193.1.2.el8_2, kernel 4.18.0-193.1.2.el8_2, bpftool 4.18.0-193.1.2.el8_2, kernel-core 4.18.0-193.1.2.el8_2, kernel-tools 4.18.0-193.1.2.el8_2, python3-perf 4.18.0-193.1.2.el8_2, +15 more
fixed: vendor fix RHSA-2020:2102
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7
fixed: vendor fix RHSA-2020:4060
Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1160.rt56.1131.el7, kernel-rt-trace 3.10.0-1160.rt56.1131.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.rt56.1131.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1160.rt56.1131.el7, kernel-rt-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-trace 3.10.0-1160.rt56.1131.el7, kernel-rt-debug-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-trace-kvm 3.10.0-1160.rt56.1131.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.rt56.1131.el7
fixed: vendor fix RHSA-2020:4062
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules-extra 4.18.0-193.1.2.rt13.53.el8_2, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-kvm 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-core 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-modules 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-kvm 4.18.0-193.1.2.rt13.53.el8_2, kernel-rt-debug-core 4.18.0-193.1.2.rt13.53.el8_2, +4 more
fixed: vendor fix RHSA-2020:2171
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-kdump 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, +7 more Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1160.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.el7 Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1160.el7, kernel 3.10.0-1160.el7, bpftool 3.10.0-1160.el7, python-perf 3.10.0-1160.el7, kernel-tools 3.10.0-1160.el7, kernel-tools-libs 3.10.0-1160.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.el7
fixed: vendor fix RHSA-2020:4060
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-30)

Exploit prediction

0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.8	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	6.8	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD	2.0	2.3	AV:A/AC:M/Au:S/C:P/I:N/A:N

Affected products

Oracle Corporation Oracle Linux

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

spinics.net /lists/kvm/msg208259.html
patch, third-party-advisory
git.kernel.org /linus/07721feee46b4b248402133228235318199b05ec
patch, third-party-advisory
git.kernel.org /linus/35a571346a94fb93b5b3b6a599675ef3384bc75c
patch, third-party-advisory
git.kernel.org /linus/e71237d3ff1abf9f3388337cfebf53b96df2020d
patch, third-party-advisory
debian.org /security/2020/dsa-4667
vendor-advisory
debian.org /security/2020/dsa-4698
vendor-advisory
openwall.com /lists/oss-security/2020/02/25/3
mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1805135
issue-tracking, third-party-advisory
linux.oracle.com /errata/ELSA-2020-5540.html
third-party-advisory
linux.oracle.com /errata/ELSA-2020-5542.html
third-party-advisory
linux.oracle.com /errata/ELSA-2020-5543.html
third-party-advisory
lists.debian.org /debian-lts-announce/2020/06/msg00011.html
mailing-list
lists.debian.org /debian-lts-announce/2020/06/msg00012.html
mailing-list
lists.debian.org /debian-lts-announce/2020/06/msg00013.html
mailing-list

Sources

CVE List CVE-2020-2732
NVD CVE-2020-2732

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary