What’s Vulnerable › Vulnerabilities

CVE-2020-27174

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-16 · updated 2026-06-17
• Weakness: CWE-401

Description

In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host.

Affected products

• AWS Firecracker: before 0.21.3; from 0.22.0 before 0.22.1 — fixed in 0.21.3, 0.22.1

How to fix

Upgrade to a fixed version: AWS Firecracker 0.21.3, 0.22.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2020/10/23/1
• https://github.com/firecracker-microvm/firecracker/issues/2177
• https://github.com/firecracker-microvm/firecracker/pull/2178
• https://github.com/firecracker-microvm/firecracker/pull/2179
• http://www.openwall.com/lists/oss-security/2020/10/23/1
• https://github.com/firecracker-microvm/firecracker/issues/2177
• https://github.com/firecracker-microvm/firecracker/pull/2178
• https://github.com/firecracker-microvm/firecracker/pull/2179

Get alerted when CVE-2020-27174 or the next vulnerability affects your stack