Skip to content
Fencer Intel
high 7.5

CVE-2020-27827 json

A flaw was found in multiple versions of OpenvSwitch.

published 5y ago modified 4mo ago also EUVD-2020-20326

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Patch / fix

  • lldpd_project lldpd 1.0.8
  • openvswitch openvswitch 2.6.9, 2.7.12, 2.8.10, 2.9.8, 2.10.6, 2.11.5, 2.12.2, 2.13.2, 2.14.1
  • siemens simatic_hmi_unified_comfort_panels_firmware 17
  • siemens tim_1531_irc_firmware 2.2
  • siemens sinumerik_one_firmware 2.0.1
  • lldpd Debian 14, Debian 13, Debian 12 1.0.8-1
  • openvswitch Debian 14, Debian 13, Debian 12 2.15.0~git20210104.def6eb1ea+dfsg1-4

debian advisories DEBIAN-CVE-2020-27827

  • openvswitch Ubuntu 16.04 LTS 2.5.9-0ubuntu0.16.04.2
  • openvswitch Ubuntu 18.04 LTS 2.9.7-0ubuntu0.18.04.2
  • openvswitch Ubuntu 20.04 LTS 2.13.1-0ubuntu0.20.04.3

ubuntu advisories UBUNTU-CVE-2020-27827

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • lldpd RHEL 9 1.0.18-4.el9
  • openvswitch2.11 RHEL 7, openstack 13 2.11.3-86.el7fdp
  • openvswitch2.11-test RHEL 7, openstack 13 2.11.3-86.el7fdp
  • python-openvswitch2.11 RHEL 7, openstack 13 2.11.3-86.el7fdp
  • openvswitch RHEL 7 2.9.9-1.el7fdp
  • openvswitch-test RHEL 7 2.9.9-1.el7fdp
  • python-openvswitch RHEL 7 2.9.9-1.el7fdp
  • redhat-virtualization-host rhev hypervisor 4.4 4.4.4-20210307.0.el8_3

red hat advisories RHSA-2024:9158RHSA-2021:2456RHSA-2021:2077RHSA-2021:0976RHSA-2021:0835RHSA-2021:0837

  • openvswitch SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 2.11.5-3.12.1
  • openvswitch SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 2.5.11-25.26.1
  • openvswitch-dpdk SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 2.5.11-25.26.1
  • openvswitch SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 2.8.10-4.23.1
  • openvswitch SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 2.7.12-3.36.1
  • openvswitch SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2.11.5-6.30.2
  • openvswitch SLES for SAP 12 SP5, SLES 12 SP5 2.11.5-3.3.2
  • openvswitch SLE Module for Server Applications 15 SP2, SLE Module for Package Hub 15 SP2 2.13.2-9.11.1

suse advisories SUSE-SU-2021:0300-1SUSE-SU-2021:0298-1SUSE-SU-2021:0297-1SUSE-SU-2021:0284-1SUSE-SU-2021:0277-1SUSE-SU-2021:0276-1

  • openvswitch openSUSE Tumbleweed 2.14.2-11.3
  • openvswitch openSUSE Leap 15.2 2.13.2-lp152.3.9.1

opensuse advisories openSUSE-SU-2024:11129-1openSUSE-SU-2021:0239-1

  • lldpd AlmaLinux 9 1.0.18-4.el9

almalinux advisories ALSA-2024:9158

  • lldpd Rocky Linux 9 1.0.18-4.el9

rocky linux advisories RLSA-2024:9158

  • lldpd Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 1.0.8-r0
  • openvswitch Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 2.12.2-r0

alpine advisories ALPINE-CVE-2020-27827

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • lldpd CBL-Mariner 2.0 1.0.14-1

azure linux advisories AZL-10443

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • lldpd Arch Linux 1.0.8-1
  • openvswitch Arch Linux 2.14.1-1

arch linux advisories AVG-1451AVG-1456

Is CVE-2020-27827 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27827 updated cvss 7.5

lldp/openvswitch: denial of service via externally triggered memory leak

  • Red Hat Fast Datapath for RHEL 7 openvswitch2.10, openvswitch2.12, openvswitch2.10-test, openvswitch2.12-test, python-openvswitch2.10, python-openvswitch2.12, +4 more Red Hat Fast Datapath for RHEL 8 openvswitch2.12, openvswitch2.12-test, python3-openvswitch2.12, network-scripts-openvswitch2.12
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 lldpd Red Hat OpenShift Container Platform 4 openvswitch2.13, openvswitch2.13-test, python3-openvswitch2.13, network-scripts-openvswitch2.13
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 10 (Newton) openvswitch, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, openvswitch-ovn-common, +2 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 13 (Queens) openvswitch, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, openvswitch-ovn-common, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 7 openvswitch 2.9.9-1.el7fdp, openvswitch-test 2.9.9-1.el7fdp, openvswitch2.11 2.11.3-86.el7fdp, openvswitch2.13 2.13.0-81.el7fdp, python-openvswitch 2.9.9-1.el7fdp, openvswitch2.11-test 2.11.3-86.el7fdp, +4 more
    fixed: vendor fix RHSA-2021:2077
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.11 2.11.3-83.el8fdp, openvswitch2.13 2.13.0-79.5.el8fdp, openvswitch2.11-test 2.11.3-83.el8fdp, openvswitch2.13-test 2.13.0-79.5.el8fdp, openvswitch2.13-ipsec 2.13.0-79.5.el8fdp, python3-openvswitch2.11 2.11.3-83.el8fdp, +3 more
    fixed: vendor fix RHSA-2021:0837
  • Red Hat Enterprise Linux AppStream (v. 9) lldpd 1.0.18-4.el9
    fixed: vendor fix RHSA-2024:9158
  • Red Hat OpenStack Platform 13.0 openvswitch2.11 2.11.3-86.el7fdp, openvswitch2.11-test 2.11.3-86.el7fdp, python-openvswitch2.11 2.11.3-86.el7fdp
    fixed: vendor fix RHSA-2021:2456
show 6 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.14-20210322.0.el7_9, redhat-virtualization-host-image-update 4.3.14-20210322.0.el7_9
    fixed: vendor fix RHSA-2021:1051
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.4-20210307.0.el8_3, redhat-virtualization-host-image-update 4.4.4-20210307.0.el8_3
    fixed: vendor fix RHSA-2021:0976
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts ovn2.11 2.11.1-57.el7fdp, ovn2.11-host 2.11.1-57.el7fdp, ovn2.11-vtep 2.11.1-57.el7fdp, openvswitch2.11 2.11.3-86.el7fdp, python-openvswitch2.11 2.11.3-86.el7fdp
    fixed: vendor fix RHSA-2021:1050
  • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch 2.9.9-1.el7fdp, python-openvswitch 2.9.9-1.el7fdp
    fixed: vendor fix RHSA-2021:2077
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.14-20210322.0.el7_9, redhat-virtualization-host-image-update 4.3.14-20210322.0.el7_9
    fixed: vendor fix RHSA-2021:1051
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.14-2.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.14-2.el7ev Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.4.4-2.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.4-2.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-194-07 updated cvss 7.5

Siemens Industrial Products LLDP (Update D)

  • Siemens SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) <V3.3.46 Siemens SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) <V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.2.28 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) <V3.0
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) <V1.1
    affected: fixed in V1.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI Unified Comfort Panels <V17
    affected: fixed in V17, mitigation support.industry.siemens.com
  • Siemens SINUMERIK ONE MCP <V2.0.1
    affected: fixed in V2.0.1, mitigation
  • Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
show 3 more
  • Siemens SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) <V3.0
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) <V3.3.46 Siemens SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) <V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.2 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.2
    affected: fixed in V2.2, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

3.24% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C

Affected products

  • n/a lldp/openvswitch

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.