What is the CVSS score of CVE-2020-25653?

CVE-2020-25653 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2020-25653?

Yes, a public proof-of-concept exploit is available for CVE-2020-25653. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2020-25653?

Yes, a patch is available for CVE-2020-25653. Update the affected software to the latest version immediately.

Spice Vdagent CVE-2020-25653

MEDIUM

Race Condition (CWE-362)

2020-11-26 secalert@redhat.com

Race Condition Denial Of Service Spice Vdagent Debian Linux Fedora

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Nov 26, 2020 - 02:15 nvd

MEDIUM 6.3

DescriptionNVD

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

AnalysisAI

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. Rated medium severity (CVSS 6.3). Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-362. A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior. Affected products include: Spice-Space Spice-Vdagent, Debian Debian Linux, Fedoraproject Fedora.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.