CVE-2020-17376

mediumpriority · track · 34EPSS 0.017 · 77 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.73% (77th) EPSS
CVSS 6.5 · medium
Is it mine?
12 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

01

cvss

Technical severity, 0–10. One row per scoring source.

8.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.3

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lprimary · NVD / NIST USexploitability 2.8 · impact 5.5
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondary · OSV
v3.17.6highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USprimaryCWE-611US
03

affected products (12)

Products and version ranges known to be affected.

04

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-0342Red Hat OpenStack: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2020-09-09csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenStack ausnutzen, um Informationen offenzulegen und weitere Angriffe mit nicht spezifizierten Auswirkungen durchzuführen.

  • GHSA-c7w7-9c85-4qxvOpenStack Nova Live migration fails to update persistent domain XML2022-05-24ghsa · osvUS

    An issue was discovered in Guest.migrate in `virt/libvirt/guest.py` in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

  • PYSEC-2020-2432020-08-26vendor · osvUS

    An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

05

also known as (6)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvcert_bundnvdNVDCVE.orgMITRE
published 2020-08-26modified 2026-06-17
08

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan