CVE-2020-24489: debian debian_linux Incomplete Cleanup
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2020-24489UBUNTU-CVE-2020-24489DEBIAN-CVE-2020-24489
Published 09-06-2021Last modified 08-10-2026
Vulnerability summary
CVE-2020-24489 is a high (CVSS 8.8) Incomplete Cleanup vulnerability in debian debian_linux. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.3% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 34 · Related 10DLA-2718-1DSA-4934-1MGASA-2021-0256OPENSUSE-SU-2021:0876-1OPENSUSE-SU-2021:1933-1OPENSUSE-SU-2024:11478-1RHSA-2021:2299RHSA-2021:2300RHSA-2021:2301RHSA-2021:2302RHSA-2021:2303RHSA-2021:2304RHSA-2021:2305RHSA-2021:2306RHSA-2021:2307RHSA-2021:2308RHSA-2021:2519RHSA-2021:2522RHSA-2021:3027RHSA-2021:3028RHSA-2021:3029RHSA-2021:3176RHSA-2021:3255RHSA-2021:3317RHSA-2021:3322RHSA-2021:3323RHSA-2021:3364SUSE-SU-2021:14758-1SUSE-SU-2021:1929-1SUSE-SU-2021:1930-1SUSE-SU-2021:1931-1SUSE-SU-2021:1932-1SUSE-SU-2021:1933-1USN-4985-1
Timeline
- 09-06-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 19-09-2026
19-09-202619-10-2026
EPSS score0.35%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Intel196 products
- atom_x5-e3930_firmwarena
- atom_x5-e3940_firmwarena
- atom_x7-e3950_firmwarena
- celeron_j1750_firmwarena
- celeron_j1800_firmwarena
Debian2 products
- intel-microcode< 3.20210608.1
- debian_linuxEOL9.0 | 10.0
Alpine1 product
- intel-ucode< 20210608-r0
Ubuntu1 product
- intel-microcode< 3.20210608.0ubuntu0.14.04.1+esm1 | < 3.20210608.0ubuntu0.16.04.1+esm1 | < 3.20210608.0ubuntu0.18.04.1 | < 3.20210608.0ubuntu0.20.04.1
4 vendors · 200 products · Showing 200 of 217. Use Open JSON for the complete list.
References
9 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.htmlX Refsource MISCREPORTVendor Advisory
- lists.debian.org/debian-lts-announce/2021/07/msg00022.htmlMailing ListX Refsource MLISTThird Party Advisory