CVE-2020-27617

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

• CWE-617

• http://www.openwall.com/lists/oss-security/2020/11/02/1Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00047.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
• https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05731.htmlMailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20201202-0002/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/11/02/1Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00047.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
• https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05731.htmlMailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20201202-0002/Third Party Advisory

Published

Nov 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27611BigBlueButton through 2.2.28 uses STUN/TURN resources from a…7.3
• CVE-2020-27612Greenlight in BigBlueButton through 2.2.28 places usernames …4.3
• CVE-2020-27613The installation procedure in BigBlueButton before 2.2.28 (o…8.4
• CVE-2020-27614AnyDesk for macOS versions 6.0.2 and older have a vulnerabil…7.8
• CVE-2020-27615The Loginizer plugin before 1.6.4 for WordPress allows SQL i…9.8
• CVE-2020-27616ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounte…6.5
• CVE-2020-27618The iconv function in the GNU C Library (aka glibc or libc6)…5.5
• CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_suppo…9.8
• CVE-2020-2762Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-27620The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS …6.1
• CVE-2020-27621The FileImporter extension in MediaWiki through 1.35.0 was n…4.3
• CVE-2020-27622In JetBrains IntelliJ IDEA before 2020.2, the built-in web s…5.3